Vulnerability in IIS Web Server Allows URL Bypass via Escape Characters
CVE-2000-0024

Currently unrated

Key Information:

Vendor
Microsoft
Status
Site Server
Internet Information Server
Site Server Commerce
Vendor
CVE Published:
21 December 1999

Summary

The IIS web server exhibits a vulnerability where it fails to properly canonicalize URLs. This oversight enables remote attackers to exploit escape characters to bypass access restrictions enforced by third-party applications. This can result in unauthorized access to sensitive resources, emphasizing the need for robust security measures to prevent exploitation.

References

http://support.microsoft.com/default.aspx?scid=kb%3B%5BLN...
vendor-advisoryx_refsource_MSKB
http://www.acrossecurity.com/aspr/ASPR-1999-11-10-1-PUB.txt
x_refsource_MISC
https://docs.microsoft.com/en-us/security-updates/securit...
vendor-advisoryx_refsource_MS

EPSS Score

12% chance of being exploited in the next 30 days.

Timeline

  • Vulnerability Reserved

  • Vulnerability published

.