Description

IIS 5.0 and 4.0 allows remote attackers to read the source code for executable web server programs by appending "%3F+.htr" to the requested URL, which causes the files to be parsed by the .HTR ISAPI extension, aka a variant of the "File Fragment Reading via .HTR" vulnerability.

Remediation

References

CVE-2001-0004

Related Vulnerabilities

Moodle Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2012-2361)

WordPress Plugin WP DSGVO Tools (GDPR) Cross-Site Request Forgery (2.2.18)

Question2Answer Improper Input Validation Vulnerability (CVE-2017-12775)

WordPress Plugin User Profile Builder-Beautiful User Registration Forms, User Profiles & User Role Editor Cross-Site Scripting (3.6.1)

WordPress Improper Input Validation Vulnerability (CVE-2011-4957)

Severity

Medium

Classification

CVE-2001-0004

Tags

Missing Update Known Vulnerabilities