XSS Vulnerability in Microsoft IIS Web Servers

CVE-2005-2089

Summary

This vulnerability in Microsoft IIS 5.0 and 6.0 enables remote attackers to exploit the server by sending crafted HTTP requests containing both a 'Transfer-Encoding: chunked' header and a Content-Length header. This misconfiguration allows the server to incorrectly process the body of the request, leading to potential web cache poisoning and enabling attackers to bypass web application firewall protections. Consequently, the attackers can conduct cross-site scripting (XSS) attacks, compromising the security of web applications relying on these IIS versions.

References