Detections
Analytics
Microsoft IIS Multiple Vulnerabilities (MS02-018)
medium Nessus Plugin ID 10936
Language:
Synopsis
The remote web server is affected by multiple vulnerabilities.Description
This IIS Server appears to be vulnerable to one of the cross-site scripting attacks described in MS02-018. The default '404' file returned by IIS uses scripting to output a link to the top level domain part of the url requested. By crafting a particular URL, it is possible to insert arbitrary script into the page for execution.The presence of this vulnerability also indicates that you are vulnerable to the other issues identified in MS02-018 (various remote buffer overflow and cross-site scripting attacks.)
Solution
Update your web serverSee Also
https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2002/ms02-018
Plugin Details
Severity: Medium
ID: 10936
File Name: iis_xss_404.nasl
Version: 1.47
Type: remote
Family: CGI abuses
Published: 4/11/2002
Updated: 1/19/2021
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5.8
CVSS v2
Risk Factor: Medium
Base Score: 4.3
Temporal Score: 3.2
Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N
Vulnerability Information
CPE: cpe:/a:microsoft:iis
Exploit Available: true
Exploit Ease: No exploit is required
Vulnerability Publication Date: 4/10/2002