Vulnerability record · CVE-2000-0778 · published 20 October 2000
CVE-2000-0778: IIS 5.0 source code disclosure via Translate: f header
Microsoft · Internet Information Services
IIS 5.0 returns the source code of .ASP files and other scripts when a remote client sends an HTTP GET request with a 'Translate: f' header, instead of executing the script. This exposes application source, which can reveal credentials, business logic and other sensitive data to any unauthenticated network client.
Description
IIS 5.0 allows remote attackers to obtain source code for .ASP files and other scripts via an HTTP GET request with a "Translate: f" header, aka the "Specialized Header" vulnerability.
AV:N/AC:L/Au:N/C:P/I:N/A:N
Automated analysis
high priorityUnauthenticated remote source code disclosure with a very high EPSS score, though the affected product is legacy and the CVSS base score is only medium.
What it is
IIS 5.0 returns the source code of .ASP files and other scripts when a remote client sends an HTTP GET request with a 'Translate: f' header, instead of executing the script. This exposes application source, which can reveal credentials, business logic and other sensitive data to any unauthenticated network client.
Impact
An attacker gains read access to server-side script source code, potentially exposing embedded credentials, connection strings and application logic that enable further attacks.
Attack surface
Reachable over the network via a crafted HTTP GET request carrying the 'Translate: f' header; no authentication or user interaction is required per the AV:N/AC:L/Au:N vector.
Exploitation
Not listed in CISA KEV and no public exploit tag is present in the references, though EPSS is very high (0.87284, 99.7th percentile), indicating elevated predicted exploitation activity.
What to do
- Apply the Microsoft security bulletin MS00-058 fix for IIS 5.0, or upgrade to a supported IIS version.
- If patching is not immediately possible, restrict or filter HTTP requests containing the 'Translate: f' header at the web server or reverse proxy.
- Remove or relocate sensitive data such as credentials and connection strings from script source files.
- Limit network exposure of IIS servers to trusted clients only.
Detection
- Search web server access logs for requests containing a 'Translate: f' header, especially targeting .asp and other script files.
- Alert on HTTP GET requests to script paths that return 200 responses with source-like content rather than executed output.
- Monitor for anomalous retrieval of multiple script files from a single client in a short window.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2000-0778 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2000-0778), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
