CVE-2000-0024

Medium

Published: 21/12/1999(UTC)Updated: 16/06/2026(UTC)Translated: 18/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

12.22%

96th percentile - higher than 96% of all known CVEs

Summary

IIS does not properly canonicalize URLs, potentially allowing remote attackers to bypass access restrictions in third-party software via escape characters.

Risk Assessment

This vulnerability may lead to unauthorized access to resources, posing a serious threat to the security of the organization's applications and data.

Recommendation

It is recommended to update IIS to the latest version and implement appropriate security measures to mitigate the risks associated with this vulnerability.

Original NVD description (English source)

IIS does not properly canonicalize URLs, potentially allowing remote attackers to bypass access restrictions in third-party software via escape characters, aka the "Escape Character Parsing" vulnerability.