Description

IIS 5 and 5.1 supporting WebDAV methods allows remote attackers to determine the internal IP address of the system (which may be obscured by NAT) via (1) a PROPFIND HTTP request with a blank Host header, which leaks the address in an HREF property in a 207 Multi-Status response, or (2) via the WRITE or MKCOL method, which leaks the IP in the Location server header.

Remediation

References

CVE-2002-0422

Related Vulnerabilities

WordPress Plugin User Login History Multiple Cross-Site Scripting Vulnerabilities (1.5.2)

WordPress Plugin Add From Server Cross-Site Request Forgery (3.3.1)

Python Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') Vulnerability (CVE-2016-5699)

WordPress Plugin yURL ReTwitt Cross-Site Request Forgery (1.4)

WordPress Plugin The Events Calendar Cross-Site Scripting (4.8.1)

Severity

Low

Classification

CVE-2002-0422 CWE-200

Tags

Missing Update Known Vulnerabilities