Lucene search

[email protected]CVE-2000-0024

HistoryDec 21, 1999 - 5:00 a.m.

CVE-2000-0024

1999-12-2105:00:00

NVD-CWE-Other

[email protected]

web.nvd.nist.gov

cve-2000-0024

iis

canonicalize urls

escape character parsing

access restrictions.

7.5 High

AI Score

Confidence

Low

6.4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:P/A:N

0.009 Low

EPSS

Percentile

82.4%

JSON

IIS does not properly canonicalize URLs, potentially allowing remote attackers to bypass access restrictions in third-party software via escape characters, aka the “Escape Character Parsing” vulnerability.

CPENameOperatorVersion
microsoft:site_servermicrosoft site servereq3.0
microsoft:internet_information_servermicrosoft internet information servereq4.0
microsoft:site_server_commercemicrosoft site server commerceeq3.0

CPE	Name	Operator	Version
microsoft:site_server	microsoft site server	eq	3.0
microsoft:internet_information_server	microsoft internet information server	eq	4.0
microsoft:site_server_commerce	microsoft site server commerce	eq	3.0

References

support.microsoft.com/default.aspx?scid=kb%3B%5BLN%5D%3BQ246401

www.acrossecurity.com/aspr/ASPR-1999-11-10-1-PUB.txt

docs.microsoft.com/en-us/security-updates/securitybulletins/1999/ms99-061

7.5 High

AI Score

Confidence

Low

6.4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:P/A:N

0.009 Low

EPSS

Percentile

82.4%

JSON