vWebServer 1.2.0 allows remote attackers to view arbitrary ASP scripts via a request for an ASP script that ends with a URL-encoded space character (%20).
https://euvd.enisa.europa.eu/vulnerability/EUVD-2001-1229
http://www.securityfocus.com/bid/2975