CVE-2000-0778: IIS 5.0 allows remote attackers to obtain source code for .ASP files and other scripts via an HTTP GET requ...

Security readout for executives and security teams

A flaw in Microsoft's Internet Information Services 5.0 web server let remote users read the raw source code of server-side scripts such as .ASP files by sending a specially crafted HTTP request. Because those scripts often hold database passwords, connection strings, and business logic, exposure could hand attackers the keys needed to move deeper into a company's systems. Exposure is limited to legacy Windows 2000 systems still running IIS 5.0 with WebDAV enabled and reachable over HTTP. Modern estates should have no exposure, but forgotten intranet servers, appliance-embedded IIS, or unmanaged lab hosts remain possible pockets. The public-source bundle does not enumerate specific product versions beyond IIS 5.0. Priority depends entirely on whether IIS 5.0 still exists in the environment. If any Windows 2000 IIS host remains, treat this as a high-priority remediation because source disclosure often leaks credentials that enable follow-on intrusion. If the estate is fully modernized, this is an audit-and-confirm item rather than urgent work. Mitigation focus: Apply Microsoft security bulletin MS00-058 or supersede it by upgrading off IIS 5.0.; Retire or isolate any remaining Windows 2000 / IIS 5.0 hosts from untrusted networks.; Disable WebDAV on IIS if it is not a documented business requirement..

Prepared

Jul 12, 2026, 00:17 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.