CVE-2000-0970

Published: Dec 19, 2000Modified: Apr 16, 2026

7.5

Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability: 10.0 / Impact: 6.4

Source: NVD

Description

IIS 4.0 and 5.0 .ASP pages send the same Session ID cookie for secure and insecure web sessions, which could allow remote attackers to hijack the secure web session of the user if that user moves to an insecure session, aka the "Session ID Cookie Marking" vulnerability.

Affected (2)

Products: Microsoft: Internet Information Server, Internet Information Services

2 products

Internet Information Server

Internet Information Services

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Microsoft Internet Information Server	Version 4.0
Microsoft Internet Information Services	Version 5.0

References (8)

http://www.acrossecurity.com/aspr/ASPR-2000-07-22-1-PUB.txt

Source: cve@mitre.org

http://www.osvdb.org/7265

Source: cve@mitre.org

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2000/ms00-080

Source: cve@mitre.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/5396

Source: cve@mitre.org

http://www.acrossecurity.com/aspr/ASPR-2000-07-22-1-PUB.txt

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.osvdb.org/7265

Source: af854a3a-2127-422b-91ae-364da2661108

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2000/ms00-080

Source: af854a3a-2127-422b-91ae-364da2661108

https://exchange.xforce.ibmcloud.com/vulnerabilities/5396

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.