CVE-1999-1223

Medium

Published: 31/12/1999(UTC)Updated: 16/06/2026(UTC)Translated: 18/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

15.72%

96th percentile - higher than 96% of all known CVEs

Summary

IIS 3.0 allows remote attackers to cause a denial of service via a request to an ASP page in which the URL contains a large number of / (forward slash) characters.

Risk Assessment

Attackers can exploit this vulnerability to block access to services running on the server, potentially leading to downtime and loss of availability.

Recommendation

It is recommended to upgrade to a newer version of IIS or implement firewall rules that limit the number of slashes in requests to the server.

Original NVD description (English source)

IIS 3.0 allows remote attackers to cause a denial of service via a request to an ASP page in which the URL contains a large number of / (forward slash) characters.