Vulnerability record · CVE-2000-0884 · published 19 December 2000
CVE-2000-0884: IIS Unicode URL decoding allows web root folder traversal
Microsoft · Internet Information Server
IIS 4.0 and 5.0 fail to properly handle malformed URLs containing UNICODE-encoded characters, allowing attackers to traverse outside the web root. This lets remote unauthenticated users read files that should not be web-accessible and may permit arbitrary command execution.
Description
IIS 4.0 and 5.0 allows remote attackers to read documents outside of the web root, and possibly execute arbitrary commands, via malformed URLs that contain UNICODE encoded characters, aka the "Web Server Folder Traversal" vulnerability.
AV:N/AC:L/Au:N/C:P/I:P/A:P
Automated analysis
high priorityRemote unauthenticated file disclosure with possible command execution and a very high EPSS score, though no KEV listing or confirmed in-the-wild exploitation is recorded.
What it is
IIS 4.0 and 5.0 fail to properly handle malformed URLs containing UNICODE-encoded characters, allowing attackers to traverse outside the web root. This lets remote unauthenticated users read files that should not be web-accessible and may permit arbitrary command execution.
Impact
An attacker can read documents outside the web root and possibly execute arbitrary commands on the server, exposing sensitive files or gaining code execution.
Attack surface
Reachable remotely over the network via crafted HTTP requests containing UNICODE-encoded traversal sequences; no authentication or user interaction is required per the AV:N/AC:L/Au:N vector.
Exploitation
Not listed in CISA KEV and no reference tags indicate known exploitation, but EPSS is 0.72073 (99.4th percentile), indicating high predicted likelihood of exploitation activity.
What to do
- Apply the Microsoft security bulletin MS00-078 patch for IIS 4.0 and 5.0 immediately.
- Upgrade to a supported IIS version if still running IIS 4.0 or 5.0.
- Restrict web server file system permissions so the IIS service account cannot read outside the web root.
- Disable unnecessary IIS features and remove unused virtual directories and sample content.
- Monitor and filter malformed or UNICODE-encoded URL requests at the web server or WAF.
Detection
- Inspect web server logs for URLs containing UNICODE-encoded traversal sequences such as %c0%af, %c1%9c, or ..%255c.
- Alert on HTTP requests that attempt to access paths outside the web root or reference system files like winnt/system32.
- Monitor for unexpected file reads or process creation by the IIS service account.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2000-0884 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2000-0884), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
