CVE-2002-0148 Cross-site scripting vulnerability in Internet Information Server (IIS) 4.0, 5.0 and 5.1 allows remote attackers to execute arbitrary script as other users via an HTTP error page.
HighCVSS 7.5
EPSS 65.5%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Cross-site scripting vulnerability in Internet Information Server (IIS) 4.0, 5.0 and 5.1 allows remote attackers to execute arbitrary script as other users via an HTTP error page.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft internet information server | = 4.0 | No fix listed |
| Microsoft internet information services | = 5.0 | No fix listed |
References
- CA-2002-09 third-party-advisory us-government-resource
- 20020415 Microsoft IIS Vulnerabilities in Cisco Products - MS02-018 vendor-advisory
- iis-http-error-page-css(8803) vdb-entry
- VU#886699 third-party-advisory us-government-resource
- 3339 vdb-entry
- 4486 vdb-entry
- MS02-018 vendor-advisory
- oval:org.mitre.oval:def:81 signature vdb-entry
- oval:org.mitre.oval:def:92 signature vdb-entry