CVE-2000-0024

MediumCVSS 6.4/10Last modified Jun 16, 2026

Description

IIS does not properly canonicalize URLs, potentially allowing remote attackers to bypass access restrictions in third-party software via escape characters, aka the "Escape Character Parsing" vulnerability.

Metrics

CVSS 2.0 6.4/10AV:N/AC:L/Au:N/C:P/I:P/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

Timeline

Published: Dec 21, 1999
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2000

CVE-2000-00255.0IIS 4.0 and Site Server 3.0 allow remote attackers to read source code for ASP files if the file is in a virtual directory whose name includ CVE-2000-002610.0Buffer overflow in UnixWare i2odialogd daemon allows remote attackers to gain root access via a long username/password authorization string.CVE-2000-00276.2IBM Network Station Manager NetStation allows local users to gain privileges via a symlink attack.CVE-2000-00282.6Internet Explorer 5.0 and 5.01 allows remote attackers to bypass the cross frame security policy and read files via the external.NavigateAnd CVE-2000-00294.6UnixWare pis and mkpis commands allow local users to gain privileges via a symlink attack.CVE-2000-00305.0Solaris dmispd dmi_cmd allows local users to fill up restricted disk space by adding files to the /var/dmi/db database.CVE-2000-00316.2The initscripts package in Red Hat Linux allows local users to gain privileges via a symlink attack.CVE-2000-003210.0Solaris dmi_cmd allows local users to crash the dmispd daemon by adding a malformed file to the /var/dmi/db database.CVE-2000-00335.0InterScan VirusWall SMTP scanner does not properly scan messages with malformed attachments.CVE-2000-00345.0Netscape 4.7 records user passwords in the preferences.js file during an IMAP or POP session, even if the user has not enabled "remember pas CVE-2000-00354.6resend command in Majordomo allows local users to gain privileges via shell metacharacters.CVE-2000-00365.0Outlook Express 5 for Macintosh downloads attachments to HTML mail without prompting the user, aka the "HTML Mail Attachment" vulnerability.