Vulnerability Details CVE-2001-0524
eEye SecureIIS versions 1.0.3 and earlier does not perform length checking on individual HTTP headers, which allows a remote attacker to send arbitrary length strings to IIS, contrary to an advertised feature of SecureIIS versions 1.0.3 and earlier.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.009
EPSS Ranking 74.1%
CVSS Severity
CVSS v2 Score 7.5
References
- http://archives.neohapsis.com/archives/bugtraq/2001-05/0185.html
- http://archives.neohapsis.com/archives/bugtraq/2001-05/0197.html
- https://exchange.xforce.ibmcloud.com/vulnerabilities/6574
- http://archives.neohapsis.com/archives/bugtraq/2001-05/0185.html
- http://archives.neohapsis.com/archives/bugtraq/2001-05/0197.html
- https://exchange.xforce.ibmcloud.com/vulnerabilities/6574
Products affected by CVE-2001-0524
-
cpe:2.3:a:eeye_digital_security:securells:*