CVE-2001-0004

MediumCVSS 5.0/10Last modified Jun 16, 2026

Description

IIS 5.0 and 4.0 allows remote attackers to read the source code for executable web server programs by appending "%3F+.htr" to the requested URL, which causes the files to be parsed by the .HTR ISAPI extension, aka a variant of the "File Fragment Reading via .HTR" vulnerability.

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:P/I:N/A:N

Affected software

No affected versions have been published.

Timeline

Published: Feb 12, 2001
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2001

CVE-2001-00056.2Buffer overflow in the parsing mechanism of the file loader in Microsoft PowerPoint 2000 allows attackers to execute arbitrary commands.CVE-2001-00067.1The Winsock2ProtocolCatalogMutex mutex in Windows NT 4.0 has inappropriate Everyone/Full Control permissions, which allows local users to mo CVE-2001-00075.0Buffer overflow in NetScreen Firewall WebUI allows remote attackers to cause a denial of service via a long URL request to the web administr CVE-2001-000810.0Backdoor account in Interbase database server allows remote attackers to overwrite arbitrary files using stored procedures.CVE-2001-00095.0Directory traversal vulnerability in Lotus Domino 5.0.5 web server allows remote attackers to read arbitrary files via a .. attack.CVE-2001-001010.0Buffer overflow in transaction signature (TSIG) handling code in BIND 8 allows remote attackers to gain root privileges.CVE-2001-001110.0Buffer overflow in nslookupComplain function in BIND 4 allows remote attackers to gain root privileges.CVE-2001-00125.0BIND 4 and BIND 8 allow remote attackers to access sensitive information such as environment variables.CVE-2001-001310.0Format string vulnerability in nslookupComplain function in BIND 4 allows remote attackers to gain root privileges.CVE-2001-00145.0Remote Data Protocol (RDP) in Windows 2000 Terminal Service does not properly handle certain malformed packets, which allows remote attacker CVE-2001-00157.2Network Dynamic Data Exchange (DDE) in Windows 2000 allows local users to gain SYSTEM privileges via a "WM_COPYDATA" message to an invisible CVE-2001-00167.2NTLM Security Support Provider (NTLMSSP) service does not properly check the function number in an LPC request, which could allow local user