CVE-2003-0526: XSS
First published: Thu Jul 17 2003(Updated: )
Cross-site scripting (XSS) vulnerability in Microsoft Internet Security and Acceleration (ISA) Server 2000 allows remote attackers to inject arbitrary web script via a URL containing the script in the domain name portion, which is not properly cleansed in the default error pages (1) 500.htm for "500 Internal Server error" or (2) 404.htm for "404 Not Found."
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Microsoft Internet Security and Acceleration Server | =2000 | |
| Microsoft Internet Security and Acceleration Server | =2000-fp1 | |
| Microsoft Internet Security and Acceleration Server | =2000-sp1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://archives.neohapsis.com/archives/vulnwatch/2003-q3/0029.html
- http://archives.neohapsis.com/archives/vulnwatch/2003-q3/0031.html
- http://pivx.com/larholm/adv/TL006
- http://marc.info/?l=bugtraq&m=105838862201266&w=2
- http://marc.info/?l=bugtraq&m=105838519729525&w=2
- http://marc.info/?l=ntbugtraq&m=105838590030409&w=2
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A117
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2003/ms03-028
Frequently Asked Questions
What is the severity of CVE-2003-0526?
CVE-2003-0526 has a moderate severity level due to its cross-site scripting vulnerability.
How do I fix CVE-2003-0526?
To fix CVE-2003-0526, apply the latest service packs or updates for Microsoft ISA Server 2000.
What are the affected versions of Microsoft ISA Server for CVE-2003-0526?
CVE-2003-0526 affects Microsoft ISA Server 2000, including versions 2000 SP1 and 2000 FP1.
What type of vulnerability is CVE-2003-0526?
CVE-2003-0526 is a cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts.
Can CVE-2003-0526 be exploited remotely?
Yes, CVE-2003-0526 can be exploited remotely through specially crafted URLs.
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/weakness
- agent/severity
- agent/author
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-historical
- vendor/microsoft
- canonical/microsoft internet security and acceleration server
- version/microsoft internet security and acceleration server/2000
- version/microsoft internet security and acceleration server/2000-fp1
- version/microsoft internet security and acceleration server/2000-sp1