Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2000-1090: Microsoft IIS 4.0/5.0 lets remote users view page source

CVE-2000-1090 · published 25 years ago

Summary

The Far East editions of Microsoft IIS version 4.0 and 5.0 can be fooled by a specially crafted web address into revealing the raw source code of the pages it serves. This could expose business logic or confidential information to anyone on the Internet. Apply Microsoft’s security update or upgrade to a newer IIS release, and consider restricting public access to the server while the fix is applied.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
microsoft	internet_information_server	4.0 5.0 `cpe:2.3:a:microsoft:internet_information_server:4.0::::far_east:::`

Original advisory text

Microsoft IIS for Far East editions 4.0 and 5.0 allows remote attackers to read source code for parsed pages via a malformed URL that uses the lead-byte of a double-byte character.

References

http://www.nsfocus.com/english/homepage/sa_08.htm Broken Link
http://www.securityfocus.com/bid/2100 Third Party Advisory VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/5729 Third Party Advisory VDB Entry

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

5.0 Medium

Exploitation

17% chance of attack within 30 days

Timeline

Published12 Feb 2001

Updated25 Oct 2026

First seen29 Sep 2026

Sources

CVE-2000-1090 · NVD

Track software like this

Free during beta