CVE-2000-0457

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

ISM.DLL in IIS 4.0 and 5.0 allows remote attackers to read file contents by requesting the file and appending a large number of encoded spaces (%20) and terminated with a .htr extension, aka the ".HTR File Fragment Reading" or "File Fragment Reading via .HTR" vulnerability.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected software

No affected versions have been published.

Timeline

Published: May 11, 2000
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2000

CVE-2000-04582.1The MSWordView application in IMP creates world-readable files in the /tmp directory, which allows other local users to read potentially sen CVE-2000-04595.0IMP does not remove files properly if the MSWordView application quits, which allows local users to cause a denial of service by filling up CVE-2000-04607.2Buffer overflow in KDE kdesud on Linux allows local uses to gain privileges via a long DISPLAY environmental variable.CVE-2000-04612.1The undocumented semconfig system call in BSD freezes the state of semaphores, which allows local users to cause a denial of service of the CVE-2000-04622.1ftpd in NetBSD 1.4.2 does not properly parse entries in /etc/ftpchroot and does not chroot the specified users, which allows those users to CVE-2000-04635.0BeOS 5.0 allows remote attackers to cause a denial of service via fragmented TCP packets.CVE-2000-04647.6Internet Explorer 4.x and 5.x allows remote attackers to execute arbitrary commands via a buffer overflow in the ActiveX parameter parsing c CVE-2000-04655.1Internet Explorer 4.x and 5.x does not properly verify the domain of a frame within a browser window, which allows a remote attacker to rea CVE-2000-04667.2AIX cdmount allows local users to gain root privileges via shell metacharacters.CVE-2000-04677.2Buffer overflow in Linux splitvt 1.6.3 and earlier allows local users to gain root privileges via a long password in the screen locking func CVE-2000-04684.6man in HP-UX 10.20 and 11 allows local attackers to overwrite files via a symlink attack.CVE-2000-04695.1Selena Sol WebBanner 4.0 allows remote attackers to read arbitrary files via a .. (dot dot) attack.