CVE-2002-1180
A typographical error in the script source access permissions for Internet Information Server (IIS) 5.0 does not properly exclude .COM files, which allows attackers with only write permissions to upload malicious .COM files, aka "Script Source Access…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (9.69%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
A typographical error in the script source access permissions for Internet Information Server (IIS) 5.0 does not properly exclude .COM files, which allows attackers with only write permissions to upload malicious .COM files, aka "Script Source Access Vulnerability."
- CVSS 2.0
- 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
- EPSS
- 9.69% probability · 95th percentile
- CISA KEV
- Not listed
- Affected
- microsoft/internet information services
- Source
- cve@mitre.org
References
- http://www.ciac.org/ciac/bulletins/n-011.shtml
- http://www.iss.net/security_center/static/10504.phpPatch, Vendor Advisory
- http://www.securityfocus.com/bid/6068
- http://www.securityfocus.com/bid/6071
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-062
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A931
- http://www.ciac.org/ciac/bulletins/n-011.shtml
- http://www.iss.net/security_center/static/10504.phpPatch, Vendor Advisory
- http://www.securityfocus.com/bid/6068
- http://www.securityfocus.com/bid/6071
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-062
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A931
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.