Vulnerability in Microsoft Internet_information_services
CVE-2011-5279
CRLF injection vulnerability in the CGI implementation in Microsoft Internet Information Services (IIS) 4.x and 5.x on Windows NT and Windows 2000 allows remote attackers to modify arbitrary uppercase environment variables via a \n (newlin…
EPSS: 0.085 (92.6th percentile) — read the EPSS interpretation.
Affected products
- Microsoft Internet_information_services — versions 4.0, 5.0
- Microsoft Windows_2000
- Microsoft Windows_nt
- N/a — versions n/a
References
- 20140419 Re: iis cgi 0day (mailing-list, Exploit, x_refsource_FULLDISC, Mailing List, Third Party Advisory)
- 20140410 Re: iis cgi 0day (mailing-list, Exploit, x_refsource_FULLDISC, Mailing List, Third Party Advisory)
- 20120401 FW: iis bug (mailing-list, Exploit, x_refsource_FULLDISC, Mailing List, Third Party Advisory)
- 20140409 iis cgi 0day (mailing-list, Exploit, x_refsource_FULLDISC, Mailing List, Third Party Advisory)
- cve@mitre.org (Third Party Advisory, x_refsource_MISC)
- 20120402 Re: iis bug (mailing-list, Exploit, x_refsource_FULLDISC, Mailing List, Third Party Advisory)