CVE-2003-1582: microsoft internet_information_server Cross-site Scripting

Vulnerability summary

CVE-2003-1582 is a low (CVSS 2.6) Cross-site Scripting vulnerability in microsoft internet_information_server. EPSS estimates a 10.32% chance of exploitation in the next 30 days, higher than 95.6% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 05-02-2010
   PublishedVulnerability first disclosed.
2. 16-09-2024
   Last modifiedVulnerability information updated.

Description

Microsoft Internet Information Services (IIS) 6.0, when DNS resolution is enabled for client IP addresses, allows remote attackers to inject arbitrary text into log files via an HTTP request in conjunction with a crafted DNS response, as demonstrated by injecting XSS sequences, related to an "Inverse Lookup Log Corruption (ILLC)" issue.

• CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.