CVE-2009-1122 The WebDAV extension in Microsoft Internet Information Services (IIS) 5.0 on Windows 2000 SP4 does not properly decode URLs, which allows remote attackers to bypass authentication, and possibly read o...
HighCVSS 7.5
EPSS 98.4%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
The WebDAV extension in Microsoft Internet Information Services (IIS) 5.0 on Windows 2000 SP4 does not properly decode URLs, which allows remote attackers to bypass authentication, and possibly read or create files, via a crafted HTTP request, aka "IIS 5.0 WebDAV Authentication Bypass Vulnerability," a different vulnerability than CVE-2009-1535.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft internet information services | = 5.0 | No fix listed |
References
- 20090616 IIS WebDav Vulnerability CVE ID mailing-list third-party-advisory
- 35232 third-party-advisory vdb-entry
- 1022358 third-party-advisory vdb-entry
- TA09-160A third-party-advisory us-government-resource
- ADV-2009-1539 third-party-advisory vdb-entry
- MS09-020 patch vendor-advisory
- oval:org.mitre.oval:def:5861 signature third-party-advisory vdb-entry