CVE-2002-1744 Directory traversal vulnerability in CodeBrws.asp in Microsoft IIS 5.0 allows remote attackers to view source code and determine the existen

What is CVE-2002-1744?

CVE-2002-1744 is a medium-severity vulnerability in Microsoft Internet Information Services, published on 21 Jun 2005.

Official description

Directory traversal vulnerability in CodeBrws.asp in Microsoft IIS 5.0 allows remote attackers to view source code and determine the existence of arbitrary files via a hex-encoded "%c0%ae%c0%ae" string, which is the Unicode representation for ".." (dot dot).

Which versions are affected by CVE-2002-1744?

It affects 1 product.

Products include Microsoft Internet Information Services.

How do I fix CVE-2002-1744?

No fix has been published for CVE-2002-1744 yet. Limit exposure of the affected software until one is available.

Is CVE-2002-1744 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2002-1744 exists.

Public exploit code: 1 Exploit-DB entry.

Other vulnerabilities in Microsoft Internet Information Services

• CVE-2017-7269 Microsoft Windows Server Buffer Overflow Exploited Critical 9.8
• CVE-2010-3972 Memory corruption in n/a Critical 10.0
• CVE-2008-4301 Other in n/a Critical 10.0
• CVE-2007-2815 The "hit-highlighting" functionality in webhits.dll in Microsoft Internet Information Services (IIS) Web Server 5.0 only uses Windows NT ACL Critical 10.0
• CVE-2003-0224 Buffer overflow in ssinc.dll for Microsoft Internet Information Services (IIS) 5.0 allows local users to execute arbitrary code via a web pa Critical 10.0

All Microsoft Internet Information Services vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-w6xh-hvr7-7x4x.