IIS 5.0 and 4.0 allows remote attackers to read the source code for
executable web server programs by appending "%3F+.htr" to the
requested URL, which causes the files to be parsed by the .HTR ISAPI
extension, aka a variant of the "File Fragment Reading via .HTR"
Note:References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
BUGTRAQ:20010108 IIS 5.0 allows viewing files using %3F+.htr
Disclaimer: The entry creation date may reflect when
the CVE-ID was allocated or reserved, and does not
necessarily indicate when this vulnerability was
discovered, shared with the affected vendor, publicly
disclosed, or updated in CVE.
This is an entry on the CVE
list, which standardizes names for security