The WebDAV extension in Microsoft Internet Information Services (IIS) 5.0 on Windows 2000 SP4 does not properly decode URLs, which allows r…

Published 17 y ago 2009-06-10 · modified 4 mo ago 2026-06-16 · JSON

CVSS

7.5

v2.0 · NVD

CISA KEV

not known exploited

EPSS

98.4%

percentile 100%

Public exploits

Metasploit · Exploit-DB

The WebDAV extension in Microsoft Internet Information Services (IIS) 5.0 on Windows 2000 SP4 does not properly decode URLs, which allows remote attackers to bypass authentication, and possibly read or create files, via a crafted HTTP request, aka "IIS 5.0 WebDAV Authentication Bypass Vulnerability," a different vulnerability than CVE-2009-1535.

Exploit prediction (EPSS)

98.45% probability of exploitation in the next 30 days, higher than 100% of all scored CVEs.

Exploits and detections

Metasploit auxiliary/scanner/http/ms09_020_webdav_unicode_bypass MS09-020 IIS6 WebDAV Unicode Authentication Bypass · metasploit auxiliary, normal rank
Metasploit auxiliary/scanner/http/dir_webdav_unicode_bypass MS09-020 IIS6 WebDAV Unicode Auth Bypass Directory Scanner · metasploit auxiliary, normal rank
EDB-8806 Microsoft IIS 6.0 - WebDAV Remote Authentication Bypass (2) · remote · 2009-05-26

CVSS scores

Assigned by	Version	Score	Vector
NVD	2.0	7.5	`AV:N/AC:L/Au:N/C:P/I:P/A:P`

Classification

Weakness

CWE-287 Improper Authentication

References

oval.cisecurity.org /repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5861 · vdb-entry, signature, x_refsource_OVAL, x_transferred
securitytracker.com /id?1022358 · vdb-entry, x_refsource_SECTRACK, x_transferred
docs.microsoft.com /en-us/security-updates/securitybulletins/2009/ms09-020 · vendor-advisory, x_refsource_MS, x_transferred
securityfocus.com /bid/35232 · vdb-entry, x_refsource_BID, x_transferred
us-cert.gov /cas/techalerts/TA09-160A.html · third-party-advisory, x_refsource_CERT, x_transferred
vupen.com /english/advisories/2009/1539 · vdb-entry, x_refsource_VUPEN, x_transferred
attrition.org /pipermail/vim/2009-June/002192.html · mailing-list, x_refsource_VIM, x_transferred

Sources

CVE List: CVE-2009-1122
NVD: CVE-2009-1122

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.