CVE-2000-0970: IIS ASP session cookie reused across secure and insecure sessions

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityThe flaw allows unauthenticated remote session hijacking with a high EPSS score, though the product is long end-of-life and no KEV or public exploit is recorded.

What it is

IIS 4.0 and 5.0 issue the same Session ID cookie for both secure (HTTPS) and insecure (HTTP) ASP sessions. Because the identifier is not marked or separated by transport, a session established over TLS can be continued over plaintext, exposing the cookie to interception. This is the "Session ID Cookie Marking" vulnerability described in Microsoft bulletin MS00-080.

Impact

An attacker who captures the session cookie from an insecure request can reuse it to hijack the user's authenticated session, gaining that user's access to the ASP application. The CVSS 2.0 vector rates partial confidentiality, integrity and availability impact.

Attack surface

Reachable remotely over the network with no authentication required (AV:N/AC:L/Au:N). Exploitation depends on the victim moving from a secure to an insecure session so the cookie is transmitted in cleartext; the record does not describe any user interaction beyond that normal browsing behavior.

Exploitation

Not listed in CISA KEV and no ransomware associations are recorded. EPSS is high (0.45657 probability, 98.7th percentile), but the references carry no exploit tags, so no confirmed public exploit is documented in this record.

What to do

• Apply the Microsoft MS00-080 security update for IIS 4.0 and 5.0, or upgrade to a supported IIS release.
• Serve all authenticated ASP content exclusively over HTTPS and redirect or block plaintext HTTP access to those pages.
• Set the Secure attribute on session cookies so browsers never send them over unencrypted connections.
• Rotate or reissue the session identifier when a user transitions between secure and insecure transport.
• Restrict exposure of legacy IIS 4.0/5.0 systems to trusted networks where interception is not feasible.

Detection

• Monitor web logs for the same ASP session cookie appearing on both HTTP and HTTPS requests from one client.
• Alert on authenticated session activity that follows a cleartext HTTP request carrying a session identifier.
• Inspect network traffic for session cookies transmitted without TLS on ports 80 or other plaintext paths.
• Correlate a single session ID with source IP changes or requests arriving over mixed schemes within a short window.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.