CVEvulnerability
CVE-2000-0024
6.4 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 1999-12-21
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 6.4 MEDIUM — AV:N/AC:L/Au:N/C:P/I:P/A:N
Description
IIS does not properly canonicalize URLs, potentially allowing remote attackers to bypass access restrictions in third-party software via escape characters, aka the "Escape Character Parsing" vulnerability.
Affected configurations
• microsoft internet information server 4.0
• microsoft site server 3.0
• microsoft site server commerce 3.0
References
- http://support.microsoft.com/default.aspx?scid=kb%3B%5BLN%5D%3BQ246401 support.microsoft.com
- http://www.acrossecurity.com/aspr/ASPR-1999-11-10-1-PUB.txt www.acrossecurity.com
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/1999/ms99-061 docs.microsoft.com
- http://support.microsoft.com/default.aspx?scid=kb%3B%5BLN%5D%3BQ246401 support.microsoft.com
- http://www.acrossecurity.com/aspr/ASPR-1999-11-10-1-PUB.txt www.acrossecurity.com
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/1999/ms99-061 docs.microsoft.com