CVE-2001-0333

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 90.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2001-06-27 · updated 2026-06-16

Description

Directory traversal vulnerability in IIS 5.0 and earlier allows remote attackers to execute arbitrary commands by encoding .. (dot dot) and "\" characters twice.

Affected products

Microsoft Internet Information Server: through 5.0; 4.0

References

http://marc.info/?l=bugtraq&m=98992056521300&w=2
http://www.cert.org/advisories/CA-2001-12.html
http://www.securityfocus.com/bid/2708
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2001/ms01-026
https://exchange.xforce.ibmcloud.com/vulnerabilities/6534
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1018
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1051
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A37
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A78
http://marc.info/?l=bugtraq&m=98992056521300&w=2
http://www.cert.org/advisories/CA-2001-12.html
http://www.securityfocus.com/bid/2708

Get alerted when CVE-2001-0333 or the next vulnerability affects your stack