CVE-2002-1180

Internet Information Server 5.0 - Unauthenticated Arbitrary File Upload via .COM File Extension

Title source: llm

Description

A typographical error in the script source access permissions for Internet Information Server (IIS) 5.0 does not properly exclude .COM files, which allows attackers with only write permissions to upload malicious .COM files, aka "Script Source Access Vulnerability."

References (6)

Core 6

Core References

Third Party Advisory, US Government Resource third-party-advisory government-resource x_refsource_ciac

http://www.ciac.org/ciac/bulletins/n-011.shtml

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/6068

Vendor Advisory vendor-advisory x_refsource_ms

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-062

Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A931

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/6071

Patch, Vendor Advisory vdb-entry x_refsource_xf

http://www.iss.net/security_center/static/10504.php

Scores

EPSS 0.0799

EPSS Percentile 94.2%

Details

Status published

Products (1)

microsoft/internet_information_services 5.0

Published Nov 12, 2002

Tracked Since Feb 18, 2026