VULNERABILITY INTELLIGENCE
CVE-2009-1122
CVSS score7.5 HIGH
EPSS probability98.45%
CISA KEVNot currently listed
Published2009-06-10
Last modified2026-06-16
CVSS vectorAV:N/AC:L/Au:N/C:P/I:P/A:P
Description
The WebDAV extension in Microsoft Internet Information Services (IIS) 5.0 on Windows 2000 SP4 does not properly decode URLs, which allows remote attackers to bypass authentication, and possibly read or create files, via a crafted HTTP request, aka "IIS 5.0 WebDAV Authentication Bypass Vulnerability," a different vulnerability than CVE-2009-1535.
Weakness classification
- CWE-287: Improper Authentication
Primary references
- secure@microsoft.com — Third Party Advisory
- secure@microsoft.com — Third Party Advisory, VDB Entry
- secure@microsoft.com — Third Party Advisory, VDB Entry
- secure@microsoft.com — Third Party Advisory, US Government Resource
- secure@microsoft.com — Third Party Advisory
- secure@microsoft.com — Patch, Vendor Advisory
- secure@microsoft.com — Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, VDB Entry
- af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, VDB Entry
- af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, US Government Resource
- af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory