CVE-2000-0970 | BDVDB-2026-1942 Detail

Description#

IIS 4.0 and 5.0 .ASP pages send the same Session ID cookie for secure and insecure web sessions, which could allow remote attackers to hijack the secure web session of the user if that user moves to an insecure session, aka the "Session ID Cookie Marking" vulnerability.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

http://www.osvdb.org/7265
https://exchange.xforce.ibmcloud.com/vulnerabilities/5396
http://www.acrossecurity.com/aspr/ASPR-2000-07-22-1-PUB.txt
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2000/ms00-080

Exploit#

No public exploit known

History#

Version 12001-01-22Record published in the CVE List.
Version 22024-08-08Most recent update recorded in the CVE List.