CVE-2003-1306

CVE-2003-1306 describes an information disclosure vulnerability in Microsoft URLScan 2.5. When the RemoveServerHeader option is enabled, remote attackers can still obtain sensitive server name and version information by triggering specific HTTP errors, such as a 400 "Bad Request," which causes the Server header to be leaked in the response. This vulnerability has a low CVSS score of 2.6, indicating a network-based attack with high access complexity and partial confidentiality impact, but no integrity or availability impact. Its EPSS score is very low, suggesting a minimal likelihood of exploitation. There is no evidence of active exploitation, and no public exploit code is available in Metasploit, Nuclei, or ExploitDB. Despite its age, it has received some community discussion, primarily on GitHub, but no media coverage.