CVE-2014-4078

CWE-2643 documents3 sources
Severity
5.1MEDIUM
EPSS
13.5%
top 5.79%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Microsoft Internet Information Services
Timeline
PublishedNov 11
Latest updateMay 14

Description

The IP Security feature in Microsoft Internet Information Services (IIS) 8.0 and 8.5 does not properly process wildcard allow and deny rules for domains within the "IP Address and Domain Restrictions" list, which makes it easier for remote attackers to bypass an intended rule set via an HTTP request, aka "IIS Security Feature Bypass Vulnerability."

CVSS vector

AV:N/AC:H/C:P/I:P/A:PExploitability: 4.9 | Impact: 6.4

Affected Packages1 packages

🔴Vulnerability Details

2
GHSA
GHSA-wxrw-ch3w-xwpr: The IP Security feature in Microsoft Internet Information Services (IIS) 8↗2022-05-14
▶
CVEList
CVE-2014-4078: The IP Security feature in Microsoft Internet Information Services (IIS) 8↗2014-11-11
▶