PT-2000-1678 · Microsoft · Iis

Published 2000-10-20 · Updated 2018-10-30 · CVE-2000-0746

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions IIS versions 4.0 through 5.0

Description The issue allows a malicious web site operator to embed scripts in a link to a trusted site. These scripts are returned without quoting in an error message back to the client, which then executes them in the same context as the trusted site.

Recommendations For IIS versions 4.0 through 5.0, consider disabling the error message feature that returns unquoted scripts to minimize the risk of exploitation. Restrict access to potentially vulnerable web pages to minimize the risk of cross-site scripting attacks.

Fix

Related Identifiers

CVE-2000-0746

Affected Products

Iis

References · 6

• http://securityfocus.com/bid/1594 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2000-0746 · Security Note
• http://securityfocus.com/bid/1595 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0746 · Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2000/ms00-060 · Note
• http://securityfocus.com/templates/archive.pike?list=1&msg=39A12BD6.E811BF4F%40nat.bg · Note