CVE-2000-0649

Microsoft IIS HTTP Internal IP Disclosure

Title source: metasploit
STIX 2.1

Description

IIS 4.0 allows remote attackers to obtain the internal IP address of the server via an HTTP 1.0 request for a web page which is protected by basic authentication and has no realm defined.

Exploits (4)

exploitdb WRITEUP VERIFIED
by Dougal Campbell · textremotewindows
https://www.exploit-db.com/exploits/20096
nomisec SCANNER 8 stars
by rafaelh · poc
https://github.com/rafaelh/CVE-2000-0649
nomisec SCANNER
by Downgraderz · poc
https://github.com/Downgraderz/PoC-CVE-2000-0649
nomisec SCANNER
by stevenvegar · poc
https://github.com/stevenvegar/cve-2000-0649

References (2)

Core 2
Core References
Exploit, Patch, Vendor Advisory mailing-list x_refsource_ntbugtraq
http://archives.neohapsis.com/archives/ntbugtraq/2000-q3/0025.html
Exploit, Patch, Vendor Advisory vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/1499

Scores

EPSS 0.6299
EPSS Percentile 98.4%

Details

CWE
CWE-200
Status published
Products (4)
microsoft/internet_information_server 3.0
microsoft/internet_information_server 4.0
microsoft/internet_information_services 2.0
microsoft/internet_information_services 5.0
Published Jul 13, 2000
Tracked Since Feb 18, 2026