Microsoft IIS Cookie information disclosure

Medium Nessus Plugin ID 12229


The remote web server is affected by an information disclosure vulnerability.


The remote host is running Microsoft IIS with what appears to be a a vulnerable disclosure of cookie usage. That is, when sent a Cookie with the '=' character, Microsoft IIS will either respond with an error (if actually processing the cookie via a specific asp page) or disclose information of the .inc file used. This can be used to map applications which are processing cookies.


Configure IIS to return custom error pages.

See Also

Plugin Details

Severity: Medium

ID: 12229

File Name: ms_invalid_cookie.nasl

Version: $Revision: 1.15 $

Type: remote

Family: Web Servers

Published: 2004/05/06

Modified: 2016/10/27

Dependencies: 10107

Risk Information

Risk Factor: Medium


Base Score: 5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

Vulnerability Information

Vulnerability Publication Date: 2004/05/06

Reference Information

OSVDB: 5993