{"cve":{"cve_id":"CVE-2000-0884","is_kev":false,"kev_date_added":null,"kev_vendor_project":null,"kev_product":null,"kev_vulnerability_name":null,"kev_short_description":null,"kev_required_action":null,"kev_due_date":null,"kev_known_ransomware":null,"kev_notes":null,"kev_cwes":null,"epss_score":0.72073,"epss_percentile":0.99382,"epss_as_of":"2026-08-26","description":"IIS 4.0 and 5.0 allows remote attackers to read documents outside of the web root, and possibly execute arbitrary commands, via malformed URLs that contain UNICODE encoded characters, aka the \"Web Server Folder Traversal\" vulnerability.","published_at":"2001-01-22T05:00:00Z","last_modified_at":"2026-06-16T21:52:40.277000Z","cvss_v3_score":null,"cvss_v3_vector":null,"cvss_v3_severity":null,"cvss_v4_score":null,"cvss_v4_vector":null,"cvss_v4_severity":null,"ssvc_decision":null,"ssvc_exploitation":null,"ssvc_automatable":null,"ssvc_technical_impact":null,"cwes":null,"nvd_references":["https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A44","https://docs.microsoft.com/en-us/security-updates/securitybulletins/2000/ms00-078","https://exchange.xforce.ibmcloud.com/vulnerabilities/5377","http://www.securityfocus.com/bid/1806","http://www.osvdb.org/436"],"vuln_status":"Modified","trending_score":null,"is_trending":false,"has_trended":false,"trended_number_one":false,"trending_peak_score":null,"trending_peak_rank":null,"started_trending_at":null,"trended_number_one_at":null,"summary_generated":null,"summary_generated_at":null,"summary_model":null,"created_at":"2026-06-24T00:09:39.878444Z","updated_at":"2026-06-28T23:02:09.533179Z"},"effective_severity":null,"badges":["exploit","epss"],"impact_analysis":[],"cvss_v3_decoded":{"version":null,"metrics":[]},"cvss_v4_decoded":{"version":null,"metrics":[]},"affected":[{"vendor_slug":"microsoft","vendor_name":"microsoft","product_slug":"internet-information-server","product_name":"internet_information_server","version_start":"4.0","version_start_inclusive":true,"version_end":"4.0","version_end_inclusive":true,"cpe23_uri":"cpe:2.3:a:microsoft:internet_information_server:4.0:*:*:*:*:*:*:*"},{"vendor_slug":"microsoft","vendor_name":"microsoft","product_slug":"internet-information-services","product_name":"internet_information_services","version_start":"5.0","version_start_inclusive":true,"version_end":"5.0","version_end_inclusive":true,"cpe23_uri":"cpe:2.3:a:microsoft:internet_information_services:5.0:*:*:*:*:*:*:*"}],"exploit_refs":[{"source":"exploit-db","kind":"exploit-db","url":"https://www.exploit-db.com/exploits/190","title":"Microsoft IIS 4.0/5.0 and PWS - Extended Unicode Directory Traversal (9)","author":"Optyx","disclosed_at":"2000-11-18"},{"source":"exploit-db","kind":"exploit-db","url":"https://www.exploit-db.com/exploits/192","title":"Microsoft IIS 4.0/5.0 and PWS - Extended Unicode Directory Traversal (8)","author":"Roelof Temmingh","disclosed_at":"2000-11-18"},{"source":"exploit-db","kind":"exploit-db","url":"https://www.exploit-db.com/exploits/191","title":"Microsoft IIS 4.0/5.0 and PWS - Extended Unicode Directory Traversal (7)","author":"steeLe","disclosed_at":"2000-11-18"},{"source":"exploit-db","kind":"exploit-db","url":"https://www.exploit-db.com/exploits/189","title":"Microsoft IIS 4.0/5.0 and PWS - Extended Unicode Directory Traversal (6)","author":"incubus","disclosed_at":"2000-11-18"},{"source":"exploit-db","kind":"exploit-db","url":"https://www.exploit-db.com/exploits/20299","title":"Microsoft IIS 4.0/5.0 and PWS - Extended Unicode Directory Traversal (2)","author":"Roelof Temmingh","disclosed_at":"2000-10-21"},{"source":"exploit-db","kind":"exploit-db","url":"https://www.exploit-db.com/exploits/20302","title":"Microsoft IIS 4.0/5.0 and PWS - Extended Unicode Directory Traversal (5)","author":"Andrea Spabam","disclosed_at":"2000-10-17"},{"source":"exploit-db","kind":"exploit-db","url":"https://www.exploit-db.com/exploits/20301","title":"Microsoft IIS 4.0/5.0 and PWS - Extended Unicode Directory Traversal (4)","author":"BoloTron","disclosed_at":"2000-10-17"},{"source":"exploit-db","kind":"exploit-db","url":"https://www.exploit-db.com/exploits/20300","title":"Microsoft IIS 4.0/5.0 and PWS - Extended Unicode Directory Traversal (3)","author":"zipo","disclosed_at":"2000-10-17"},{"source":"exploit-db","kind":"exploit-db","url":"https://www.exploit-db.com/exploits/20298","title":"Microsoft IIS 4.0/5.0 and PWS - Extended Unicode Directory Traversal (1)","author":"Gabriel Maggiotti","disclosed_at":"2000-10-17"}],"news":[],"references":[{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A44","source_type":"MISC","tags":[]},{"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2000/ms00-078","source_type":"MISC","tags":[]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/5377","source_type":"MISC","tags":[]},{"url":"http://www.securityfocus.com/bid/1806","source_type":"MISC","tags":[]},{"url":"http://www.osvdb.org/436","source_type":"MISC","tags":[]}],"timeline":[{"type":"exploit_known","at":"2000-10-17T00:00:00Z","label":"Public exploit available","source":"exploit-db"},{"type":"published","at":"2001-01-22T05:00:00Z","label":"CVE published","source":null}]}