low2.6Public exploit code
CVE-2000-0649
IIS 4.0 allows remote attackers to obtain the internal IP address of the server via an HTTP 1.0 request for a web page which is protected by basic authenticati…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Microsoft IIS 2.0/3.0/4.0/5.0/5.1 - Internal IP Address Disclosure2000-07-13 · remote · windows · Verified
Impact
IIS 4.0 allows remote attackers to obtain the internal IP address of the server via an HTTP 1.0 request for a web page which is protected by basic authentication and has no realm defined.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Microsoft | Internet Information Server | Versions 3.0, 4.0 |
| Microsoft | Internet Information Services | Versions 2.0, 5.0 |