What happened
IIS 4.0 and 5.0 allows remote attackers to read documents outside of the web root, and possibly execute arbitrary commands, via malformed URLs that contain UNICODE encoded characters, aka the "Web Server Folder Traversal" vulnerability.
Affected versions
n/a: n/a Fixed: See vendor advisory.
Why it matters
Review the vendor advisory and exposure of the affected product to determine operational impact.
Detection & mitigation
- Apply vendor-provided updates or mitigations.
- Review affected product exposure and access logs.
Public PoC references
RepositoryAuthorFirst seenReference
Exploit-DB 20298Microsoft IIS 4.0/5.0 and PWS - Extended Unicode Directory Traversal (1)Gabriel Maggiotti2000-10-17VerifiedExploit-DB 20299Microsoft IIS 4.0/5.0 and PWS - Extended Unicode Directory Traversal (2)Roelof Temmingh2000-10-21VerifiedExploit-DB 20300Microsoft IIS 4.0/5.0 and PWS - Extended Unicode Directory Traversal (3)zipo2000-10-17VerifiedExploit-DB 20301Microsoft IIS 4.0/5.0 and PWS - Extended Unicode Directory Traversal (4)BoloTron2000-10-17VerifiedExploit-DB 20302Microsoft IIS 4.0/5.0 and PWS - Extended Unicode Directory Traversal (5)Andrea Spabam2000-10-17VerifiedExploit-DB 189Microsoft IIS 4.0/5.0 and PWS - Extended Unicode Directory Traversal (6)incubus2000-11-18VerifiedExploit-DB 191Microsoft IIS 4.0/5.0 and PWS - Extended Unicode Directory Traversal (7)steeLe2000-11-18VerifiedExploit-DB 192Microsoft IIS 4.0/5.0 and PWS - Extended Unicode Directory Traversal (8)Roelof Temmingh2000-11-18VerifiedExploit-DB 190Microsoft IIS 4.0/5.0 and PWS - Extended Unicode Directory Traversal (9)Optyx2000-11-18VerifiedSource timeline
CVE record published by NVDView source ↗
Record history
Record created from the first normalized source observation.
Metadata and source references refreshed.