7.5high
CVE-2002-1745in critical feed
Off-by-one error in the CodeBrws.asp sample script in Microsoft IIS 5.0 allows remote attackers to view the source code for files with exte…
Published 23 y ago · modified 4 mo ago · JSON
CVSS
7.5
v3.1 · NVD
CISA KEV
No
not known exploited
EPSS
19.1%
percentile 97%
Public exploits
0
none known
Summary
Off-by-one error in the CodeBrws.asp sample script in Microsoft IIS 5.0 allows remote attackers to view the source code for files with extensions containing with one additional character after .html, .htm, .asp, or .inc, such as .aspx files.
Exploit prediction (EPSS)
19.11% probability of exploitation in the next 30 days, higher than 97% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N |
Classification
- Weakness
- CWE-193 Off-by-one Error
References
- exchange.xforce.ibmcloud.com /vulnerabilities/8853 · vdb-entry, x_refsource_XF, x_transferred
- online.securityfocus.com /archive/1/268303 · mailing-list, x_refsource_BUGTRAQ, x_transferred
- securityfocus.com /bid/4543 · vdb-entry, x_refsource_BID, x_transferred
Sources
- CVE List: CVE-2002-1745
- NVD: CVE-2002-1745
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.