Description
IIS 4.0 allows remote attackers to obtain the internal IP address of the server via an HTTP 1.0 request for a web page which is protected by basic authentication and has no realm defined.
Exploits (4)
exploitdb
WRITEUP
VERIFIED
by Dougal Campbell · textremotewindows
https://www.exploit-db.com/exploits/20096
References (2)
Core 2
Core References
Exploit, Patch, Vendor Advisory mailing-list
x_refsource_ntbugtraq
http://archives.neohapsis.com/archives/ntbugtraq/2000-q3/0025.html
Exploit, Patch, Vendor Advisory vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/1499
Scores
EPSS
0.6299
EPSS Percentile
98.4%
Details
CWE
CWE-200
Status
published
Products (4)
microsoft/internet_information_server
3.0
microsoft/internet_information_server
4.0
microsoft/internet_information_services
2.0
microsoft/internet_information_services
5.0
Published
Jul 13, 2000
Tracked Since
Feb 18, 2026