CVE-2001-0333 Directory traversal vulnerability in IIS 5.0 and earlier allows remote attackers to execute arbitrary commands by encoding .. (dot dot) and "" characters twice.
HighCVSS 7.5
EPSS 90.8%
Framework module
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Directory traversal vulnerability in IIS 5.0 and earlier allows remote attackers to execute arbitrary commands by encoding .. (dot dot) and "" characters twice.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft internet information server | <= 5.0 | No fix listed |
| Microsoft internet information server | = 4.0 | No fix listed |
References
- 20010515 NSFOCUS SA2001-02 : Microsoft IIS CGI Filename Decode Error Vulnerability mailing-list
- CA-2001-12 third-party-advisory us-government-resource
- 2708 vdb-entry
- MS01-026 vendor-advisory
- iis-url-decoding(6534) vdb-entry
- oval:org.mitre.oval:def:1018 signature vdb-entry
- oval:org.mitre.oval:def:1051 signature vdb-entry
- oval:org.mitre.oval:def:37 signature vdb-entry
- oval:org.mitre.oval:def:78 signature vdb-entry