CVE-2000-1104: High severity microsoft internet information services vulnerability

Published Dec 19, 2000

Updated

Variant of the "IIS Cross-Site Scripting" vulnerability as originally discussed in MS:MS00-060 (CVE-2000-0746) allows a malicious web site operator to embed scripts in a link to a trusted site, which are returned without quoting in an error message back to the client. The client then executes those scripts in the same context as the trusted site.

Affected Software

2 affected components

Microsoft Internet Information Server=4.0

Microsoft Internet Information Services=5.0

Event History

Dec 19, 2000

CVE Published

via MITRE·05:00 AM

Data Sourced

via MITRE·05:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2000-1104?

CVE-2000-1104 is classified as a medium severity vulnerability.

How do I fix CVE-2000-1104?

To fix CVE-2000-1104, apply the security updates released by Microsoft for Internet Information Services.

What software versions are affected by CVE-2000-1104?

CVE-2000-1104 affects Microsoft Internet Information Services 5.0 and Internet Information Server 4.0.

What type of attack does CVE-2000-1104 enable?

CVE-2000-1104 enables cross-site scripting attacks by allowing the injection of malicious scripts into error messages.

When was CVE-2000-1104 publicly disclosed?

CVE-2000-1104 was publicly disclosed as part of Microsoft Security Bulletin MS00-060.