CVE-2009-1122

HIGH 7.5CVE-2009-1122 · Published 10/06/2009 · updated 16/06/2026

Package	Affected versions	Patched versions
internet information services microsoft	`= 5.0`	No fix yet

Description

The WebDAV extension in Microsoft Internet Information Services (IIS) 5.0 on Windows 2000 SP4 does not properly decode URLs, which allows remote attackers to bypass authentication, and possibly read or create files, via a crafted HTTP request, aka "IIS 5.0 WebDAV Authentication Bypass Vulnerability," a different vulnerability than CVE-2009-1535.

References

attrition.org/pipermail/vim/2009-June/002192.html · Third Party Advisory
securityfocus.com/bid/35232 · Third Party Advisory
securitytracker.com/id · Third Party Advisory
us-cert.gov/cas/techalerts/TA09-160A.html · Third Party Advisory
vupen.com/english/advisories/2009/1539 · Third Party Advisory
docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-020 · Patch
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5861 · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free