Vulnerability record · CVE-2002-0148 · published 22 April 2002
CVE-2002-0148: Microsoft IIS HTTP error page cross-site scripting
Microsoft · Internet Information Server
Microsoft IIS 4.0, 5.0 and 5.1 fail to properly encode content in HTTP error pages, allowing reflected cross-site scripting. An attacker can craft a request that causes the server to return a page containing arbitrary script, which executes in the victim's browser in the context of the affected site.
Description
Cross-site scripting vulnerability in Internet Information Server (IIS) 4.0, 5.0 and 5.1 allows remote attackers to execute arbitrary script as other users via an HTTP error page.
AV:N/AC:L/Au:N/C:P/I:P/A:P
Automated analysis
high priorityHigh EPSS probability and network-reachable XSS with partial impact, though exploitation requires user interaction and no KEV listing.
What it is
Microsoft IIS 4.0, 5.0 and 5.1 fail to properly encode content in HTTP error pages, allowing reflected cross-site scripting. An attacker can craft a request that causes the server to return a page containing arbitrary script, which executes in the victim's browser in the context of the affected site.
Impact
An attacker can execute arbitrary script as other users, potentially stealing session cookies, hijacking authenticated sessions, or performing actions on behalf of the victim. The CVSS 2.0 vector indicates partial confidentiality, integrity and availability impact.
Attack surface
Reachable remotely over the network via HTTP requests to IIS error pages; no authentication is required. Successful exploitation requires the victim to follow a crafted link or otherwise load the malicious request, so some user interaction is needed.
Exploitation
Not listed in CISA KEV and no public exploit references are tagged in the record, but EPSS is high at 0.64489 (99.2nd percentile), indicating elevated likelihood of exploitation activity.
What to do
- Apply the Microsoft security bulletin MS02-018 update for IIS 4.0, 5.0 and 5.1.
- Disable or restrict custom error pages that reflect user-supplied input where feasible.
- Deploy a WAF or URL filtering rule to block script payloads in requests that trigger IIS error pages.
- Upgrade to a supported IIS version, as IIS 4.0/5.0/5.1 are long out of support.
- Enforce output encoding for any server-generated error content.
Detection
- Monitor IIS logs for requests containing script tags or encoded script in query strings or paths that result in error responses.
- Alert on HTTP responses with status 4xx/5xx that include reflected user input in the body.
- Review web server error page templates for unencoded dynamic content.
- Correlate suspicious error-page requests with subsequent session anomalies or cookie theft indicators.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2002-0148 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2002-0148), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.
