PT-2000-1354 · Microsoft · Iis

Published 2000-05-06 · Updated 2018-10-30 · CVE-2000-0413

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions IIS versions 4.0 through 5.0

Description The issue allows remote attackers to determine the physical path of certain files, including HTML, HTM, ASP, and SHTML files, by requesting a non-existent file. This action generates an error message that reveals the path.

Recommendations For IIS versions 4.0 through 5.0, consider restricting access to the shtml.exe program as a temporary workaround until a patch is available.

Exploit

Fix

Related Identifiers

CVE-2000-0413

Affected Products

Iis

References · 5

• 🔥 https://exploit-db.com/exploits/19897 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2000-0413 · Security Note
• http://securityfocus.com/bid/1174 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0413 · Note
• http://archives.neohapsis.com/archives/bugtraq/2000-05/0084.html · Note