What’s Vulnerable › Vulnerabilities

CVE-2002-1180

• Severity: high (CVSS 7.5 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 9.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2002-11-12 · updated 2026-06-16

Description

A typographical error in the script source access permissions for Internet Information Server (IIS) 5.0 does not properly exclude .COM files, which allows attackers with only write permissions to upload malicious .COM files, aka "Script Source Access Vulnerability."

Affected products

• Microsoft IIS: 5.0

References

• http://www.ciac.org/ciac/bulletins/n-011.shtml
• http://www.iss.net/security_center/static/10504.php
• http://www.securityfocus.com/bid/6068
• http://www.securityfocus.com/bid/6071
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-062
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A931
• http://www.ciac.org/ciac/bulletins/n-011.shtml
• http://www.iss.net/security_center/static/10504.php
• http://www.securityfocus.com/bid/6068
• http://www.securityfocus.com/bid/6071
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-062
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A931

Get alerted when CVE-2002-1180 or the next vulnerability affects your stack