CVE-2000-0770: Microsoft Internet Information Server

Medium severity, CVSS 6.4. EPSS: 15.1% chance of exploitation in the next 30 days.

IIS 4.0 and 5.0 does not properly restrict access to certain types of files when their parent folders have less restrictive permissions, which could allow remote attackers to bypass access restrictions to some files, aka the "File Permission Canonicalization" vulnerability.

Affected products

• Microsoft Internet Information Server: version 4.0 only
• Microsoft Internet Information Services: version 5.0 only

Published 2000-10-20. Last modified 2026-06-16.