CVE-2000-0970

{"id": "CVE-2000-0970", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": true, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2000-12-19T05:00:00.000", "references": [{"url": "http://www.acrossecurity.com/aspr/ASPR-2000-07-22-1-PUB.txt", "source": "cve@mitre.org"}, {"url": "http://www.osvdb.org/7265", "source": "cve@mitre.org"}, {"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2000/ms00-080", "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/5396", "source": "cve@mitre.org"}, {"url": "http://www.acrossecurity.com/aspr/ASPR-2000-07-22-1-PUB.txt", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.osvdb.org/7265", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2000/ms00-080", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/5396", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "IIS 4.0 and 5.0 .ASP pages send the same Session ID cookie for secure and insecure web sessions, which could allow remote attackers to hijack the secure web session of the user if that user moves to an insecure session, aka the \"Session ID Cookie Marking\" vulnerability."}, {"lang": "es", "value": "Las p\u00e1ginas .ASP de IIS 4.0 y 5.0 env\u00edan la misma cookie de ID de sesi\u00f3n para sesiones web seguras e inseguras, lo que podr\u00eda permitir a atacantes remotos secuestrar la sesi\u00f3n web segura del usuario si ese usuario se mueve a una sesi\u00f3n insegura, tambi\u00e9n conocida como la vulnerabilidad 'Session ID Cookie Marking'."}], "lastModified": "2026-09-23T10:10:00.673", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:internet_information_server:4.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5D47E9C4-5439-4A82-BBD8-D6B482B47E51"}, {"criteria": "cpe:2.3:a:microsoft:internet_information_services:5.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "413C07EA-139F-4B7D-A58B-835BD2591FA0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}