Get a demo
100% Signal 0% Noise Invicti Logo - The Largest Dynamic Application Security Solutions Provider In The World Get a demo
Internet Information Services Exposure of Sensitive Information to an Unauthorized Actor Vulnerability - CVE-2002-0422 - Vulnerability Database
Internet Information Services

Internet Information Services Exposure of Sensitive Information to an Unauthorized Actor Vulnerability - CVE-2002-0422

Low
Reference: CVE-2002-0422
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2002-0422
Title: Internet Information Services Exposure of Sensitive Information to an Unauthorized Actor Vulnerability
Overview:

IIS 5 and 5.1 supporting WebDAV methods allows remote attackers to determine the internal IP address of the system (which may be obscured by NAT) via (1) a PROPFIND HTTP request with a blank Host header which leaks the address in an HREF property in a 207 Multi-Status response or (2) via the WRITE or MKCOL method which leaks the IP in the Location server header.