CVE-2000-0970: IIS 4.0 and 5.0 .ASP pages send the same Session ID cookie for secure and insecure web sessions, which coul...

Security readout for executives and security teams

Microsoft IIS 4.0 and 5.0 web servers issued the same session cookie whether a user was on a secure (HTTPS) page or an insecure (HTTP) page. If an attacker could observe unencrypted traffic, they could capture that cookie and reuse it to impersonate the user inside the encrypted session, defeating the protection HTTPS was meant to provide. Very limited today. Affected products are IIS 4.0 (Windows NT 4.0) and IIS 5.0 (Windows 2000), both long past end of support. Exposure persists only in unmaintained legacy environments still running classic ASP on these platforms behind mixed HTTP/HTTPS sites. Low priority for modern estates and moderate only where legacy IIS 4.0/5.0 remains. Treat any surviving instance as end-of-life risk to be scheduled for decommissioning rather than a standalone patch cycle. Mitigation focus: Apply Microsoft security bulletin MS00-080 on any surviving IIS 4.0/5.0 hosts.; Retire IIS 4.0 and 5.0; migrate ASP workloads to a supported Windows Server and IIS release.; Enforce HTTPS site-wide and disable plaintext HTTP listeners for authenticated apps..

Prepared

Jul 11, 2026, 23:58 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.