PT-2002-1163 · Microsoft · Internet Information Server

Published 2002-04-22 · Updated 2020-11-23 · CVE-2002-0074

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Internet Information Server (IIS) versions 4.0 through 5.1

Description A cross-site scripting issue in the Help File search facility allows remote attackers to embed scripts into another user's session.

Recommendations For IIS versions 4.0 through 5.1, consider disabling the Help File search facility as a temporary workaround until a patch is available. Restrict access to the search facility to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2002-0074

Affected Products

Internet Information Server

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2002-0074 · Security Note
• http://cisco.com/warp/public/707/Microsoft-IIS-vulnerabilities-MS02-018.shtml · Vendor Advisory
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-018 · Vendor Advisory
• http://osvdb.org/3338 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A46 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0074 · Note
• http://kb.cert.org/vuls/id/883091 · Note
• http://securityfocus.com/bid/4483 · Note
• http://cgisecurity.com/advisory/9.txt · Note
• http://cert.org/advisories/CA-2002-09.html · Note
• http://iss.net/security_center/static/8802.php · Note
• http://seclists.org/bugtraq/2002/Apr/0126.html · Note