CVE-2000-0246
MediumExploitation Probability (EPSS)
Very high risk100th percentile - higher than 100% of all known CVEs
Summary
IIS 4.0 and 5.0 does not properly perform ISAPI extension processing if a virtual directory is mapped to a UNC share, allowing remote attackers to read the source code of ASP and other files.
Risk Assessment
Attackers may gain access to sensitive data, potentially leading to information disclosure and further attacks on web applications.
Recommendation
It is recommended to avoid mapping virtual directories to UNC shares and to upgrade to a newer version of IIS that is not vulnerable to this issue.
Original NVD description (English source)
IIS 4.0 and 5.0 does not properly perform ISAPI extension processing if a virtual directory is mapped to a UNC share, which allows remote attackers to read the source code of ASP and other files, aka the "Virtualized UNC Share" vulnerability.