Unrated severityNVD Advisory· Published Dec 19, 2000· Updated Apr 16, 2026
CVE-2000-0970
CVE-2000-0970
Description
IIS 4.0 and 5.0 .ASP pages send the same Session ID cookie for secure and insecure web sessions, which could allow remote attackers to hijack the secure web session of the user if that user moves to an insecure session, aka the "Session ID Cookie Marking" vulnerability.
Affected products
2- cpe:2.3:a:microsoft:internet_information_server:4.0:*:*:*:*:*:*:*
- cpe:2.3:a:microsoft:internet_information_services:5.0:*:*:*:*:*:*:*
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
4News mentions
0No linked articles in our index yet.