PT-2002-2467 · Microsoft · Iis

Published 2002-12-31 · Updated 2024-02-15 · CVE-2002-1745

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Microsoft IIS version 5.0

Description The issue is related to an off-by-one error in the CodeBrws.asp sample script. This error allows remote attackers to view the source code for files with extensions containing one additional character after .html, .htm, .asp, or .inc, such as .aspx files.

Recommendations For Microsoft IIS version 5.0, consider removing or restricting access to the CodeBrws.asp sample script until a fix is available. As a temporary workaround, restrict access to files with extensions that could be exploited by this issue.

Fix

Weakness Enumeration

CWE-193

Related Identifiers

CVE-2002-1745

Affected Products

Iis

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2002-1745 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/8853 · Note
• https://t.me/cvenotify/71666 · Telegram Post
• http://securityfocus.com/bid/4543 · Note
• http://online.securityfocus.com/archive/1/268303 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1745 · Note