Vulnerability in Microsoft Internet_information_server
CVE-2005-2678
Microsoft IIS 5.1 and 6 allows remote attackers to spoof the SERVER_NAME variable to bypass security checks and conduct various attacks via a GET request with an http://localhost URI, which makes it appear as if the request is coming from…
EPSS: 0.398 (98.5th percentile) — read the EPSS interpretation.
Affected products
- Microsoft Internet_information_server — versions 6.0
- Microsoft Internet_information_services — versions 5.0
- N/a — versions n/a
Public proof-of-concept exploits
References
- cve@mitre.org (x_refsource_MISC)
- cve@mitre.org (vdb-entry, x_refsource_VUPEN)
- cve@mitre.org (x_refsource_SECUNIA, Vendor Advisory, third-party-advisory)
- cve@mitre.org (mailing-list, x_refsource_BUGTRAQ)
Frequently asked questions
- What is CVE-2005-2678?
- CVE-2005-2678 is a vulnerability in Microsoft Internet_information_server. Published 2005-08-23.
- Is CVE-2005-2678 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.