CVE-2003-0526: microsoft isa_server
Vulnerability summary
CVE-2003-0526 is a medium (CVSS 6.8) vulnerability in microsoft isa_server. EPSS estimates a 22.47% chance of exploitation in the next 30 days, higher than 97.6% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 17-07-2003PublishedVulnerability first disclosed.
- 08-08-2024Last modifiedVulnerability information updated.
Description
Cross-site scripting (XSS) vulnerability in Microsoft Internet Security and Acceleration (ISA) Server 2000 allows remote attackers to inject arbitrary web script via a URL containing the script in the domain name portion, which is not properly cleansed in the default error pages (1) 500.htm for "500 Internal Server error" or (2) 404.htm for "404 Not Found."
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
22.47%
Chance of exploitation in the next 30 days
Percentile
98%
Versus all other CVEs
30-day change
0.00 pp
From 22.47% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundMicrosoft ISA Server 2000 - Cross-Site Scripting
Maturity: weaponized
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Microsoft1 product
- isa_server2000 | 2000:fp1 | 2000:sp1
1 vendor · 1 product
References
8 links- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A117VDB EntrySignatureX Refsource OVAL
docs.microsoft.com/en-us/security-updates/securitybulletins/2003/ms03-028Vendor AdvisoryX Refsource MS- archives.neohapsis.com/archives/vulnwatch/2003-q3/0029.htmlMailing ListX Refsource VULNWATCHVendor Advisory
- pivx.com/larholm/adv/TL006X Refsource MISC