CVE-2002-1745 in the critical feed json
Off-by-one error in the CodeBrws.asp sample script in Microsoft IIS 5.0 allows remote attackers to view the source code for files with exte…
published 2002-12-31 23 y ago modified 2026-06-16 4 mo ago also EUVD-2002-1724
- cvss
- 7.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 19.1%
- EPSS 19.1% chance of exploitation in 30 days, percentile 97%
- public exploits
- 0
- none known
Summary
Off-by-one error in the CodeBrws.asp sample script in Microsoft IIS 5.0 allows remote attackers to view the source code for files with extensions containing with one additional character after .html, .htm, .asp, or .inc, such as .aspx files.
Exploit prediction
19.11% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N |
Classification
- Weakness
-
- CWE-193 Off-by-one Error
References
-
exchange.xforce.ibmcloud.com
/vulnerabilities/8853
vdb-entry, third-party-advisory
-
online.securityfocus.com
/archive/1/268303
mailing-list, broken-link, third-party-advisory, vdb-entry
-
securityfocus.com
/bid/4543
vdb-entry, broken-link, third-party-advisory
Sources
- CVE List CVE-2002-1745
- NVD CVE-2002-1745
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.