CVE-2000-0746

5 documents4 sources
Severity
7.5HIGH
EPSS
18.3%
top 4.79%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Microsoft Internet Information ServerMicrosoft Internet Information Services
Timeline
PublishedOct 20
Latest updateApr 30

Description

Vulnerabilities in IIS 4.0 and 5.0 do not properly protect against cross-site scripting (CSS) attacks. They allow a malicious web site operator to embed scripts in a link to a trusted site, which are returned without quoting in an error message back to the client. The client then executes those scripts in the same context as the trusted site, aka the "IIS Cross-Site Scripting" vulnerabilities.

CVSS vector

AV:N/AC:L/C:P/I:P/A:PExploitability: 10.0 | Impact: 6.4

Affected Packages2 packages

Patches

Patch: www.securityfocus.com ↗Patch: www.securityfocus.com ↗Patch: www.securityfocus.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-93vc-c3w9-g6c9: Vulnerabilities in IIS 4↗2022-04-30
▶
CVEList
CVE-2000-0746: Vulnerabilities in IIS 4↗2000-09-21
▶

💥Exploits & PoCs

2
Exploit-DB
iPlanet 4.1 Web Publisher - Remote Buffer Overflow (1)↗2001-05-15
▶
Exploit-DB
iPlanet 4.1 Web Publisher - Remote Buffer Overflow (2)↗2001-05-15
▶
CVE-2000-0746 (HIGH CVSS 7.5) | Vulnerabilities in IIS 4.0 and 5.0 | cvebase.io