CVE-2000-0649

Severity: low (CVSS 2.6 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 76.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2000-07-13 · updated 2026-06-16
Weakness: CWE-200

Description

IIS 4.0 allows remote attackers to obtain the internal IP address of the server via an HTTP 1.0 request for a web page which is protected by basic authentication and has no realm defined.

Affected products

Microsoft Internet Information Server: 3.0, 4.0
Microsoft IIS: 2.0, 5.0

References

http://archives.neohapsis.com/archives/ntbugtraq/2000-q3/0025.html
http://www.securityfocus.com/bid/1499
http://archives.neohapsis.com/archives/ntbugtraq/2000-q3/0025.html
http://www.securityfocus.com/bid/1499

Get alerted when CVE-2000-0649 or the next vulnerability affects your stack