CVE

Id
2322  
CVE No.
CVE-2000-0746  
Status
Candidate  
Description
Vulnerabilities in IIS 4.0 and 5.0 do not properly protect against cross-site scripting (CSS) attacks. They allow a malicious web site operator to embed scripts in a link to a trusted site, which are returned without quoting in an error message back to the client. The client then executes those scripts in the same context as the trusted site, aka the "IIS Cross-Site Scripting" vulnerabilities.  
Phase
Proposed (20000921)  
Votes
ACCEPT(3) Cole, Levy, Wall | MODIFY(1) Frech | REVIEWING(1) Christey  
Comments
Christey> Make sure both BID"s are appropriate | XF:iis-cross-site-scripting | http://xforce.iss.net/static/5156.php | Frech> XF: iis-cross-site-scripting(5156) | CHANGE> [Christey changed vote from NOOP to REVIEWING] | Christey> A re-release of MS:MS00-060 indicates that a new variant of | this problem was discovered, but the advisory does not | provide sufficient details to distinguish it from this | candidate. A new candidate is being created, but the | description can"t be written without mentioning this CAN.  

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
8466 2322 CVE-2000-0746 BUGTRAQ:20000821 IIS 5.0 cross site scripting vulnerability - using .shtml files or /_vti_bin/shtml.dll  View
8467 2322 CVE-2000-0746 URL:http://www.securityfocus.com/templates/archive.pike?list=1&msg=39A12BD6.E811BF4F@nat.bg  View
8468 2322 CVE-2000-0746 MS:MS00-060  View
8469 2322 CVE-2000-0746 URL:http://www.microsoft.com/technet/security/bulletin/ms00-060.asp  View
8470 2322 CVE-2000-0746 BID:1594  View
8471 2322 CVE-2000-0746 URL:http://www.securityfocus.com/bid/1594  View
8472 2322 CVE-2000-0746 BID:1595  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
64278 JVNDB-2000-000058 Microsoft IIS における shtml 形式のリクエストを利用したクロスサイトスクリプティングの脆弱性 Microsoft IIS には、テキストが追加されている shtml 形式のファイルへのリクエストを受信した際に、それに対するエラーメッセージに実行可能なスクリプトを含めることが可能である脆弱性が存在します。 CVE-2000-0746 2322 7.5 http://jvndb.jvn.jp/ja/contents/2000/JVNDB-2000-000058.html  View