CVE-2001-0004
Internet Information Server 4.0-5.0 - Unauthenticated Source Code Disclosure via .HTR ISAPI Extension
Title source: llmDescription
IIS 5.0 and 4.0 allows remote attackers to read the source code for executable web server programs by appending "%3F+.htr" to the requested URL, which causes the files to be parsed by the .HTR ISAPI extension, aka a variant of the "File Fragment Reading via .HTR" vulnerability.
References (4)
Core 4
Core References
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/2313
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/5903
Vendor Advisory vendor-advisory
x_refsource_ms
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2001/ms01-004
Mailing List mailing-list
x_refsource_bugtraq
http://marc.info/?l=bugtraq&m=97897954625305&w=2
Scores
EPSS
0.2666
EPSS Percentile
97.8%
Details
Status
published
Products (2)
microsoft/internet_information_server
4.0
microsoft/internet_information_services
5.0
Published
Feb 12, 2001
Tracked Since
Feb 18, 2026