CVEvulnerability
CVE-2000-0884
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2000-12-19
- Last modified
- 2026-09-23
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
Description
IIS 4.0 and 5.0 allows remote attackers to read documents outside of the web root, and possibly execute arbitrary commands, via malformed URLs that contain UNICODE encoded characters, aka the "Web Server Folder Traversal" vulnerability.
Affected configurations
• microsoft internet information server 4.0
• microsoft internet information services 5.0
Related
Referenced by CWE · observed example (1)
- CWE-176 Improper Handling of Unicode Encoding weakness
References
- http://www.osvdb.org/436 www.osvdb.org
- http://www.securityfocus.com/bid/1806 www.securityfocus.com
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2000/ms00-078 docs.microsoft.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/5377 exchange.xforce.ibmcloud.com
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A44 oval.cisecurity.org
- http://www.osvdb.org/436 www.osvdb.org
- http://www.securityfocus.com/bid/1806 www.securityfocus.com
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2000/ms00-078 docs.microsoft.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/5377 exchange.xforce.ibmcloud.com
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A44 oval.cisecurity.org