1. CVE-Search
  2. CVE-2002-1181
ID CVE-2002-1181
Summary Multiple cross-site scripting (XSS) vulnerabilities in the administrative web pages for Microsoft Internet Information Server (IIS) 4.0 through 5.1 allow remote attackers to execute HTML script as other users through (1) a certain ASP file in the IISHELP virtual directory, or (2) possibly other unknown attack vectors.
References
Vulnerable Configurations
  • cpe:2.3:a:microsoft:internet_information_server:4.0:*:*:*:*:*:*:*
    cpe:2.3:a:microsoft:internet_information_server:4.0:*:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:internet_information_services:5.0:*:*:*:*:*:*:*
    cpe:2.3:a:microsoft:internet_information_services:5.0:*:*:*:*:*:*:*
CVSS
Base: 6.8 (as of 23-11-2020 - 19:49)
Impact:
Exploitability:
CWE NVD-CWE-Other
CAPEC
Access
VectorComplexityAuthentication
NETWORK MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
cvss-vector via4 AV:N/AC:M/Au:N/C:P/I:P/A:P
oval via4
  • accepted 2005-02-16T12:00:00.000-04:00
    class vulnerability
    contributors
    • name Christine Walzer
      organization The MITRE Corporation
    • name Christine Walzer
      organization The MITRE Corporation
    description Multiple cross-site scripting (XSS) vulnerabilities in the administrative web pages for Microsoft Internet Information Server (IIS) 4.0 through 5.1 allow remote attackers to execute HTML script as other users through (1) a certain ASP file in the IISHELP virtual directory, or (2) possibly other unknown attack vectors.
    family windows
    id oval:org.mitre.oval:def:942
    status accepted
    submitted 2004-05-12T12:00:00.000-04:00
    title Windows 2000 IIS Cross-site Scripting Vulnerabilities
    version 65
  • accepted 2007-08-02T14:47:16.767-04:00
    class vulnerability
    contributors
    • name Christine Walzer
      organization The MITRE Corporation
    • name Robert L. Hollis
      organization ThreatGuard, Inc.
    description Multiple cross-site scripting (XSS) vulnerabilities in the administrative web pages for Microsoft Internet Information Server (IIS) 4.0 through 5.1 allow remote attackers to execute HTML script as other users through (1) a certain ASP file in the IISHELP virtual directory, or (2) possibly other unknown attack vectors.
    family windows
    id oval:org.mitre.oval:def:944
    status accepted
    submitted 2004-05-12T12:00:00.000-04:00
    title Windows NT IIS Cross-site Scripting Vulnerabilities
    version 28
refmap via4
bid
  • 6068
  • 6072
bugtraq 20021105 [SNS Advisory No.58] Microsoft IIS Local Cross-site Scripting Vulnerability
ciac N-011
misc http://www.lac.co.jp/security/intelligence/SNSAdvisory/58.html
xf iis-admin-pages-xss(10501)
Last major update 23-11-2020 - 19:49
Published 12-11-2002 - 05:00
Last modified 23-11-2020 - 19:49
Back to Top