CVE-2003-1567
 
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
3Exploited in Wild
-Decision
Descriptions
The undocumented TRACK method in Microsoft Internet Information Services (IIS) 5.0 returns the content of the original request in the body of the response, which makes it easier for remote attackers to steal cookies and authentication credentials, or bypass the HttpOnly protection mechanism, by using TRACK to read the contents of the HTTP headers that are returned in the response, a technique that is similar to cross-site tracing (XST) using HTTP TRACE.
El método no documentado TRACK en Microsoft Internet Information Services (IIS) v5.0 devuelve el contenido de la petición original en el cuerpo de la respuesta, lo que facilita a atacantes remotos el robo de cookies y credenciales de autenticación, o evitar el mecanismo de protección HttpOnly, usando TRAK para leer los contenidos de las cabeceras HTTP que se devuelven en la respuesta. Una técnica similar al rastreo de sitios cruzados (XST) usando HTTP TRACE.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2009-01-14 CVE Reserved
- 2009-01-15 CVE Published
- 2024-09-16 CVE Updated
- 2024-09-16 First Exploit
- 2024-10-06 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CAPEC
References (4)
URL | Tag | Source |
---|---|---|
http://www.kb.cert.org/vuls/id/288308 | Third Party Advisory |
URL | Date | SRC |
---|---|---|
http://archives.neohapsis.com/archives/ntbugtraq/2003-q4/0321.html | 2024-09-16 | |
http://www.aqtronix.com/Advisories/AQ-2003-02.txt | 2024-09-16 | |
http://www.osvdb.org/5648 | 2024-09-16 |
URL | Date | SRC |
---|
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Microsoft Search vendor "Microsoft" | Internet Information Services Search vendor "Microsoft" for product "Internet Information Services" | 5.0 Search vendor "Microsoft" for product "Internet Information Services" and version "5.0" | - |
Affected
|