CVE-2000-0413 json
The shtml.exe program in the FrontPage extensions package of IIS 4.0 and 5.0 allows remote attackers to determine the physical path of HTML…
published 2000-05-06 26 y ago modified 2026-06-16 4 mo ago also EUVD-2000-0412
- cvss
- 5.0
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 43.9%
- EPSS 43.9% chance of exploitation in 30 days, percentile 98%
- public exploits
- 1
- Exploit-DB
Summary
The shtml.exe program in the FrontPage extensions package of IIS 4.0 and 5.0 allows remote attackers to determine the physical path of HTML, HTM, ASP, and SHTML files by requesting a file that does not exist, which generates an error message that reveals the path.
Timeline
- First public exploit (EDB-19897)
- Published
Exploit prediction
43.89% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- EDB-19897 FrontPage 2000 / IIS 4.0/5.0 - Server Extensions Full Path Disclosure remote, 2000-05-06
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N |
References
-
archives.neohapsis.com
/archives/bugtraq/2000-05/0084.html
mailing-list
-
securityfocus.com
/bid/1174
vdb-entry
Sources
- CVE List CVE-2000-0413
- NVD CVE-2000-0413
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.