Vulnerability in N/a
CVE-2000-0886
IIS 5.0 allows remote attackers to execute arbitrary commands via a malformed request for an executable file whose name is appended with operating system commands, aka the "Web Server File Request Parsing" vulnerability.
EPSS: 0.892 (99.6th percentile) — read the EPSS interpretation.
Affected products
- N/a — versions n/a
Public proof-of-concept exploits
References
- oval:org.mitre.oval:def:191 (signature, x_refsource_OVAL, vdb-entry)
- MS00-086 (x_refsource_MS, vendor-advisory)
- 20001107 NSFOCUS SA2000-07 : Microsoft IIS 4.0/5.0 CGI File Name Inspection Vulnerability (mailing-list, x_refsource_BUGTRAQ)
- 1912 (vdb-entry, x_refsource_BID)
- iis-invalid-filename-passing(5470) (vdb-entry, x_refsource_XF)
Frequently asked questions
- What is CVE-2000-0886?
- CVE-2000-0886 is a vulnerability in N/a. Published 2001-01-22.
- Is CVE-2000-0886 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.