7.5high
CVE-2000-0746in critical feed
Vulnerabilities in IIS 4.0 and 5.0 do not properly protect against cross-site scripting (CSS) attacks.
Published 26 y ago · modified 4 mo ago · JSON
CVSS
7.5
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
10.1%
percentile 96%
Public exploits
0
none known
Summary
Vulnerabilities in IIS 4.0 and 5.0 do not properly protect against cross-site scripting (CSS) attacks. They allow a malicious web site operator to embed scripts in a link to a trusted site, which are returned without quoting in an error message back to the client. The client then executes those scripts in the same context as the trusted site, aka the "IIS Cross-Site Scripting" vulnerabilities.
Exploit prediction (EPSS)
10.09% probability of exploitation in the next 30 days, higher than 96% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
References
- securityfocus.com /templates/archive.pike?list=1&msg=39A12BD6.E811BF4F%40nat.bg · mailing-list, x_refsource_BUGTRAQ, x_transferred
- securityfocus.com /bid/1594 · vdb-entry, x_refsource_BID, x_transferred
- securityfocus.com /bid/1595 · vdb-entry, x_refsource_BID, x_transferred
- docs.microsoft.com /en-us/security-updates/securitybulletins/2000/ms00-060 · vendor-advisory, x_refsource_MS, x_transferred
Sources
- CVE List: CVE-2000-0746
- NVD: CVE-2000-0746
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.