CVE-2000-0246: microsoft commercial_internet_system
Vulnerability summary
CVE-2000-0246 is a medium (CVSS 5.0) vulnerability in microsoft commercial_internet_system. EPSS estimates a 79.98% chance of exploitation in the next 30 days, higher than 99.6% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 02-06-2000PublishedVulnerability first disclosed.
- 08-08-2024Last modifiedVulnerability information updated.
Description
IIS 4.0 and 5.0 does not properly perform ISAPI extension processing if a virtual directory is mapped to a UNC share, which allows remote attackers to read the source code of ASP and other files, aka the "Virtualized UNC Share" vulnerability.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
79.98%
Chance of exploitation in the next 30 days
Percentile
100%
Versus all other CVEs
30-day change
0.00 pp
From 79.98% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundMicrosoft IIS 4.0 - UNC Mapped Virtual Host
Maturity: weaponized
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Microsoft6 products
- commercial_internet_system2.0 | 2.5
- internet_information_server4.0
- internet_information_services5.0
- proxy_server2.0
- site_server3.0
1 vendor · 6 products
References
3 links
docs.microsoft.com/en-us/security-updates/securitybulletins/2000/ms00-019Vendor AdvisoryX Refsource MS