CVE-2000-0884
IIS 4.0 and 5.0 allows remote attackers to read documents outside of the web root, and possibly...
CVE-2000-0884 is a high vulnerability (CVSS 7.5) in Microsoft Internet Information Server, published December 19, 2000. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 63.3%, the 99th percentile. No source names a fixed version.
IIS 4.0 and 5.0 allows remote attackers to read documents outside of the web root, and possibly execute arbitrary commands, via malformed URLs that contain UNICODE encoded characters, aka the "Web Server Folder Traversal" vulnerability.
Exploit likelihood
What each source reports
NVD Score used
IIS 4.0 and 5.0 allows remote attackers to read documents outside of the web root, and possibly execute arbitrary commands, via malformed URLs that contain UNICODE encoded characters, aka the "Web Server Folder Traversal" vulnerability.
- Record
CVE-2000-0884- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
IIS 4.0 and 5.0 allows remote attackers to read documents outside of the web root, and possibly execute arbitrary commands, via malformed URLs that contain UNICODE encoded characters, aka the "Web Server Folder Traversal" vulnerability.
- Record
CVE-2000-0884- Updated
- 2026-11-02
EUVDEUVD-2000-0871 No score
IIS 4.0 and 5.0 allows remote attackers to read documents outside of the web root, and possibly execute arbitrary commands, via malformed URLs that contain UNICODE encoded characters, aka the "Web Server Folder Traversal" vulnerability.
- Record
EUVD-2000-0871- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-3gpv-hgg9-gfg5 No score
IIS 4.0 and 5.0 allows remote attackers to read documents outside of the web root, and possibly...
IIS 4.0 and 5.0 allows remote attackers to read documents outside of the web root, and possibly execute arbitrary commands, via malformed URLs that contain UNICODE encoded characters, aka the "Web Server Folder Traversal" vulnerability.
- Record
GHSA-3gpv-hgg9-gfg5- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Microsoft IIS 4.0/5.0 and PWS - Extended Unicode Directory Traversal (6) | 2000-11-18 |
| Exploit-DB | Microsoft IIS 4.0/5.0 and PWS - Extended Unicode Directory Traversal (9) | 2000-11-18 |
| Exploit-DB | Microsoft IIS 4.0/5.0 and PWS - Extended Unicode Directory Traversal (7) | 2000-11-18 |
| Exploit-DB | Microsoft IIS 4.0/5.0 and PWS - Extended Unicode Directory Traversal (8) | 2000-11-18 |
| Exploit-DB | Microsoft IIS 4.0/5.0 and PWS - Extended Unicode Directory Traversal (1) | 2000-10-17 |
| Exploit-DB | Microsoft IIS 4.0/5.0 and PWS - Extended Unicode Directory Traversal (2) | 2000-10-21 |
| Exploit-DB | Microsoft IIS 4.0/5.0 and PWS - Extended Unicode Directory Traversal (3) | 2000-10-17 |
| Exploit-DB | Microsoft IIS 4.0/5.0 and PWS - Extended Unicode Directory Traversal (4) | 2000-10-17 |
| Exploit-DB | Microsoft IIS 4.0/5.0 and PWS - Extended Unicode Directory Traversal (5) | 2000-10-17 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, Exploit-DB, GitHub Advisories, NVD |
References
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A44
docs.microsoft.com/en-us/security-updates/securitybulletins/2000/ms00-078
exchange.xforce.ibmcloud.com/vulnerabilities/5377
securityfocus.com/bid/1806
osvdb.org/436
nvd.nist.gov/vuln/detail/CVE-2000-0884
github.com/advisories/GHSA-3gpv-hgg9-gfg5