CVE-2000-0884
IIS 4.0 and 5.0 allows remote attackers to read documents outside of the web root, and possibly...
CVE-2000-0884 is a high vulnerability (CVSS 7.5) in Microsoft Internet Information Server, published December 19, 2000. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 63.3%, the 99th percentile. No source names a fixed version.
- Severity
- 7.5 HighCVSS 2.0, NVD
- Exploit chance
- 63.3%EPSS, 99th percentile
- Exploitation
- None known9 public exploits
- Fixed in
- No fix listedNo source names one
Description
IIS 4.0 and 5.0 allows remote attackers to read documents outside of the web root, and possibly execute arbitrary commands, via malformed URLs that contain UNICODE encoded characters, aka the "Web Server Folder Traversal" vulnerability.
Exploit likelihood
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Microsoft IIS 4.0/5.0 and PWS - Extended Unicode Directory Traversal (1) | 2000-10-17 |
| Exploit-DB | Microsoft IIS 4.0/5.0 and PWS - Extended Unicode Directory Traversal (3) | 2000-10-17 |
| Exploit-DB | Microsoft IIS 4.0/5.0 and PWS - Extended Unicode Directory Traversal (4) | 2000-10-17 |
| Exploit-DB | Microsoft IIS 4.0/5.0 and PWS - Extended Unicode Directory Traversal (5) | 2000-10-17 |
| Exploit-DB | Microsoft IIS 4.0/5.0 and PWS - Extended Unicode Directory Traversal (2) | 2000-10-21 |
| Exploit-DB | Microsoft IIS 4.0/5.0 and PWS - Extended Unicode Directory Traversal (6) | 2000-11-18 |
| Exploit-DB | Microsoft IIS 4.0/5.0 and PWS - Extended Unicode Directory Traversal (9) | 2000-11-18 |
| Exploit-DB | Microsoft IIS 4.0/5.0 and PWS - Extended Unicode Directory Traversal (7) | 2000-11-18 |
| Exploit-DB | Microsoft IIS 4.0/5.0 and PWS - Extended Unicode Directory Traversal (8) | 2000-11-18 |
What each source reports
NVD Score used
IIS 4.0 and 5.0 allows remote attackers to read documents outside of the web root, and possibly execute arbitrary commands, via malformed URLs that contain UNICODE encoded characters, aka the "Web Server Folder Traversal" vulnerability.
- Record
CVE-2000-0884- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE ListNo score
IIS 4.0 and 5.0 allows remote attackers to read documents outside of the web root, and possibly execute arbitrary commands, via malformed URLs that contain UNICODE encoded characters, aka the "Web Server Folder Traversal" vulnerability.
- Record
CVE-2000-0884- Updated
- 2026-11-02
EUVDEUVD-2000-0871No score
IIS 4.0 and 5.0 allows remote attackers to read documents outside of the web root, and possibly execute arbitrary commands, via malformed URLs that contain UNICODE encoded characters, aka the "Web Server Folder Traversal" vulnerability.
- Record
EUVD-2000-0871- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-3gpv-hgg9-gfg5No score
IIS 4.0 and 5.0 allows remote attackers to read documents outside of the web root, and possibly...
IIS 4.0 and 5.0 allows remote attackers to read documents outside of the web root, and possibly execute arbitrary commands, via malformed URLs that contain UNICODE encoded characters, aka the "Web Server Folder Traversal" vulnerability.
- Record
GHSA-3gpv-hgg9-gfg5- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| exploits, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A44
docs.microsoft.com/en-us/security-updates/securitybulletins/2000/ms00-078
exchange.xforce.ibmcloud.com/vulnerabilities/5377
securityfocus.com/bid/1806
osvdb.org/436
nvd.nist.gov/vuln/detail/CVE-2000-0884
github.com/advisories/GHSA-3gpv-hgg9-gfg5