CVE-2000-0413
MediumExploitation Probability (EPSS)
Very high risk99th percentile - higher than 99% of all known CVEs
Summary
The shtml.exe program in the FrontPage extensions package of IIS 4.0 and 5.0 allows remote attackers to determine the physical path of HTML, HTM, ASP, and SHTML files by requesting a non-existent file, which generates an error message revealing the path.
Risk Assessment
Revealing the physical path of files may lead to further attacks on the system, allowing attackers to better understand the application structure and potentially exploit other vulnerabilities.
Recommendation
It is recommended to update the system to the latest version and configure appropriate security rules to limit the disclosure of file path information.
Original NVD description (English source)
The shtml.exe program in the FrontPage extensions package of IIS 4.0 and 5.0 allows remote attackers to determine the physical path of HTML, HTM, ASP, and SHTML files by requesting a file that does not exist, which generates an error message that reveals the path.