CVE-2002-1745 - Off-by-one error in the CodeBrws.asp sample script in Microsoft IIS 5.0 allows remote attackers to v

CVE-2002-1745

Summary

Off-by-one error in the CodeBrws.asp sample script in Microsoft IIS 5.0 allows remote attackers to view the source code for files with extensions containing with one additional character after .html, .htm, .asp, or .inc, such as .aspx files.

References

http://online.securityfocus.com/archive/1/268303
http://www.securityfocus.com/bid/4543
https://exchange.xforce.ibmcloud.com/vulnerabilities/8853

Vulnerable Configurations

cpe:2.3:a:microsoft:internet_information_services:5.0:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:internet_information_services:5.0:*:*:*:*:*:*:*

CVSS

Base:	5.0 (as of 15-02-2024 - 21:28)
Impact:
Exploitability:

CWE

CWE-193

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	LOW	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	NONE	NONE

cvss-vector via4

AV:N/AC:L/Au:N/C:P/I:N/A:N

refmap via4

bid	4543
bugtraq	20020418 Re: Microsoft IIS 5.0 CodeBrws.asp Source Disclosure
xf	iis-codebrws-view-source(8853)

Last major update

15-02-2024 - 21:28

Published

31-12-2002 - 05:00

Last modified

15-02-2024 - 21:28