Microsoft IIS 4.0 and 5.0 are vulnerable to double dot "../" directory traversal exploitation if extended UNICODE character representations are used in substitution for "/" and "". Unauthenticated users may access any known file in the context of the IUSR_machinename account. Successful exploitation would yield the same privileges as a user who could successfully log onto the system to a remote user possessing no credentials whatsoever."