Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.0

IIS 5.0 may reveal folder listings via WebDAV

CVE-2000-0951 · published 25 years ago
Summary

If IIS 5.0 is set up with the Index Server feature turned on and the Index option enabled, anyone on the internet can request a list of the files and folders in the web site's root folder. This can expose confidential files or give clues for further attacks. Turn off the Index Server feature or disable the Index setting, and consider disabling WebDAV if it is not needed.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
microsoft internet_information_services 5.0
cpe:2.3:a:microsoft:internet_information_services:5.0:*:*:*:*:*:*:*
Original advisory text
A misconfiguration in IIS 5.0 with Index Server enabled and the Index property set allows remote attackers to list directories in the web root via a Web Distributed Authoring and Versioning (WebDAV...
A misconfiguration in IIS 5.0 with Index Server enabled and the Index property set allows remote attackers to list directories in the web root via a Web Distributed Authoring and Versioning (WebDAV) search.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.0 Medium
Exploitation
44% chance of attack within 30 days
Timeline
Published19 Dec 2000
Updated29 Sep 2026
First seen29 Sep 2026
Sources
CVE-2000-0951 · NVD
Track software like this
Free during beta