CVE-2017-7269 is a critical buffer overflow vulnerability in the WebDAV service of Microsoft IIS 6.0, affecting Windows Server 2003 R2. This flaw allows remote attackers to execute arbitrary code by sending a specially crafted PROPFIND request with a long "If: <http://" header. With a CVSS score of 9.8, it presents a severe risk due to its network-based attack vector, low complexity, and complete compromise of confidentiality, integrity, and availability. This vulnerability has been actively exploited in the wild since at least 2016, with public Metasploit modules and Nuclei templates available, and has garnered significant community discussion and media attention, often linked to cryptocurrency mining campaigns.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
6.0CPE matchmatch criteria | cpe:2.3:a:microsoft:internet_information_services:6.0:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.