Internet Information Services
Vendor:
First CVE: Feb 25, 1996 · Active for 30 years
93
Total CVEs
More Total CVEs than 99% of tracked products
5.8
Avg CVEs / Year
Higher CVE frequency than 90% of tracked products
6.2
Avg CVSS
Higher Avg CVSS than 25% of tracked products
1.1%
KEV Rate
Higher KEV Rate than 96% of tracked products
Trends Over Time
The number and severity of CVEs published that impact Internet Information Services over time
Volume of CVEsAvg CVSS Base Score
First CVE
Feb 25, 1996
30 years ago
Most Recent CVE
Mar 27, 2017
3,406 days ago
CVE Severity & Scoring
Internet Information Services93 CVEs
55%
41%
All CVEs352,294 CVEs
45%
40%
11%
LowMediumHighCritical
Attack Vector
Local0 (0.0%)
Network4 (4.3%)
Unknown89 (95.7%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low4 (4.3%)
High0 (0.0%)
Unknown89 (95.7%)
User Interaction
None4 (4.3%)
Unknown89 (95.7%)
Required0 (0.0%)
Privileges Required
Low0 (0.0%)
High0 (0.0%)
None4 (4.3%)
Unknown89 (95.7%)
Top CVEs
Signals from CVEs in this product scope (93 CVEs).
93 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2017-7269CRITICAL Buffer overflow in the ScStoragePathFromUrl function in the WebDAV service in Internet Information Services (IIS) 6.0 in Microsoft Windows Server 2003 R2 allows remote attackers to | Mar 27, 2017 | 9.8 | 99 | YES | YES |
CVE-2010-3972HIGH Heap-based buffer overflow in the TELNET_STREAM_CONTEXT::OnSendData function in ftpsvc.dll in Microsoft FTP Service 7.0 and 7.5 for Internet Information Services (IIS) 7.0, and IIS | Dec 23, 2010 | 10.0 | 91 | NO | YES |
CVE-2009-1122HIGH The WebDAV extension in Microsoft Internet Information Services (IIS) 5.0 on Windows 2000 SP4 does not properly decode URLs, which allows remote attackers to bypass authentication, | Jun 10, 2009 | 7.5 | 88 | NO | YES |
CVE-2009-1535HIGH The WebDAV extension in Microsoft Internet Information Services (IIS) 5.1 and 6.0 allows remote attackers to bypass URI-based protection mechanisms, and list folders or read, creat | Jun 10, 2009 | 7.5 | 88 | NO | YES |
CVE-2009-2521MEDIUM Stack consumption vulnerability in the FTP Service in Microsoft Internet Information Services (IIS) 5.0 through 7.0 allows remote authenticated users to cause a denial of service ( | Sep 4, 2009 | 5.0 | 78 | NO | YES |
CVE-2007-2815HIGH The "hit-highlighting" functionality in webhits.dll in Microsoft Internet Information Services (IIS) Web Server 5.0 only uses Windows NT ACL configuration, which allows remote atta | May 22, 2007 | 10.0 | 77 | NO | YES |
CVE-2005-4360HIGH The URL parser in Microsoft Internet Information Services (IIS) 5.1 on Windows XP Professional SP2 allows remote attackers to execute arbitrary code via multiple requests to ".dll" | Dec 20, 2005 | 7.8 | 73 | NO | YES |
CVE-2000-0884HIGH IIS 4.0 and 5.0 allows remote attackers to read documents outside of the web root, and possibly execute arbitrary commands, via malformed URLs that contain UNICODE encoded characte | Dec 19, 2000 | 7.5 | 73 | NO | YES |
CVE-2006-0026MEDIUM Buffer overflow in Microsoft Internet Information Services (IIS) 5.0, 5.1, and 6.0 allows local and possibly remote attackers to execute arbitrary code via crafted Active Server Pa | Jul 11, 2006 | 6.5 | 72 | NO | YES |
CVE-2003-0718MEDIUM The WebDAV Message Handler for Internet Information Services (IIS) 5.0, 5.1, and 6.0 allows remote attackers to cause a denial of service (memory and CPU exhaustion, application cr | Nov 3, 2004 | 5.0 | 71 | NO | YES |
Exploit Exposure
Signals from CVEs in this product scope (93 CVEs).
CISA KEV
1 CVE
1.1% of CVEs· 96th percentile
Metasploit
8 CVEs
8.6% of CVEs· 97th percentile
Nuclei
1 CVE
1.1% of CVEs· 96th percentile
ExploitDB
39 CVEs
41.9% of CVEs· 91st percentile
Social Chatter
Signals from CVEs in this product scope (93 CVEs).
Media Mentions
Signals from CVEs in this product scope (93 CVEs).
Top CNAs Publishing CVEs For Internet Information Services
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 8.5 | 1 | 5.1 | 18.0% | 0 | 0 |
| 8.0 | 1 | 5.1 | 18.0% | 0 | 0 |
| 7.5 | 3 | 7.9 | 61.5% | 0 | 2 |
| 6.0 | 4 | 6.9 | 73.1% | 1 | 2 |
| 5.1 | 5 | 6.6 | 41.4% | 0 | 2 |
| 5.0 | 70 | 6.0 | 38.4% | 0 | 29 |
| 4.0 | 1 | 5.0 | 19.0% | 0 | 0 |
| 2.0 | 7 | 5.6 | 24.0% | 0 | 5 |
| 1.0 | 3 | 7.3 | 8.5% | 0 | 1 |