CVE-2000-0025

Medium

Published: 21/12/1999(UTC)Updated: 16/06/2026(UTC)Translated: 17/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

34.85%

98th percentile - higher than 98% of all known CVEs

Summary

IIS 4.0 and Site Server 3.0 allow remote attackers to read source code for ASP files if the file is in a virtual directory whose name includes extensions such as .com, .exe, .sh, .cgi, or .dll.

Risk Assessment

Attackers may gain access to sensitive information contained in ASP files, potentially leading to further attacks on the system.

Recommendation

It is recommended to avoid using file extensions in the names of virtual directories and to upgrade to newer versions of the software that eliminate this vulnerability.

Original NVD description (English source)

IIS 4.0 and Site Server 3.0 allow remote attackers to read source code for ASP files if the file is in a virtual directory whose name includes extensions such as .com, .exe, .sh, .cgi, or .dll, aka the "Virtual Directory Naming" vulnerability.