CVE-2000-0746
First published: Thu Sep 21 2000(Updated: )
Vulnerabilities in IIS 4.0 and 5.0 do not properly protect against cross-site scripting (CSS) attacks. They allow a malicious web site operator to embed scripts in a link to a trusted site, which are returned without quoting in an error message back to the client. The client then executes those scripts in the same context as the trusted site, aka the "IIS Cross-Site Scripting" vulnerabilities.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Microsoft Office FrontPage | ||
| Microsoft Internet Information Services | =4.0 | |
| Microsoft Internet Information Services (IIS) | =5.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.securityfocus.com/bid/1594
- http://www.securityfocus.com/bid/1595
- http://www.securityfocus.com/templates/archive.pike?list=1&msg=39A12BD6.E811BF4F@nat.bg
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2000/ms00-060
- http://www.securityfocus.com/templates/archive.pike?list=1&msg=39A12BD6.E811BF4F%40nat.bg
Frequently Asked Questions
What is the severity of CVE-2000-0746?
CVE-2000-0746 is considered a high-severity vulnerability due to its potential to allow cross-site scripting attacks.
How do I fix CVE-2000-0746?
To fix CVE-2000-0746, it is recommended to upgrade to a later version of IIS, or implement appropriate input validation measures.
What software is affected by CVE-2000-0746?
CVE-2000-0746 affects Microsoft Internet Information Server 4.0, Internet Information Services 5.0, and Microsoft Office FrontPage.
What types of attacks can be executed due to CVE-2000-0746?
CVE-2000-0746 allows attackers to perform cross-site scripting (CSS) attacks, potentially executing malicious scripts on users' browsers.
Is CVE-2000-0746 still relevant today?
While CVE-2000-0746 is an older vulnerability, it serves as a reminder of the importance of securing web applications against cross-site scripting.
- agent/type
- agent/remedy
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/severity
- agent/weakness
- agent/references
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- agent/softwarecombine
- collector/nvd-api
- agent/software-canonical-lookup-request
- collector/nvd-historical
- collector/nvd-index
- agent/author
- vendor/microsoft
- canonical/microsoft office frontpage
- canonical/microsoft internet information services
- version/microsoft internet information services/4.0
- canonical/microsoft internet information services (iis)
- version/microsoft internet information services (iis)/5.0