{"id":"CVE-2009-1122","aliases":["EUVD-2009-1123","GHSA-c9gf-r7p8-qf28"],"status":"published","title":"The WebDAV extension in Microsoft Internet Information Services (IIS) 5.0 on Windows 2000 SP4...","description":"The WebDAV extension in Microsoft Internet Information Services (IIS) 5.0 on Windows 2000 SP4 does not properly decode URLs, which allows remote attackers to bypass authentication, and possibly read or create files, via a crafted HTTP request, aka \"IIS 5.0 WebDAV Authentication Bypass Vulnerability,\" a different vulnerability than CVE-2009-1535.","severity":{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.98447,"percentile":0.99919,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-287"],"published":"2009-06-10T18:00:00Z","modified":"2026-06-16T23:06:33Z","exploits":[{"source":"exploitdb","id":"EDB-8806","title":"Microsoft IIS 6.0 - WebDAV Remote Authentication Bypass (2)","type":"remote","platform":"windows","date":"2009-05-26","verified":true,"url":"https://www.exploit-db.com/exploits/8806"},{"source":"metasploit","id":"auxiliary/scanner/http/dir_webdav_unicode_bypass","title":"MS09-020 IIS6 WebDAV Unicode Auth Bypass Directory Scanner","type":"auxiliary","verified":true,"url":"https://www.rapid7.com/db/modules/auxiliary/scanner/http/dir_webdav_unicode_bypass"},{"source":"metasploit","id":"auxiliary/scanner/http/ms09_020_webdav_unicode_bypass","title":"MS09-020 IIS6 WebDAV Unicode Authentication Bypass","type":"auxiliary","verified":true,"url":"https://www.rapid7.com/db/modules/auxiliary/scanner/http/ms09_020_webdav_unicode_bypass"}],"products":[{"vendor":"microsoft","product":"internet_information_services"}],"references":[{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5861","tags":["vdb-entry","signature","x_refsource_OVAL","x_transferred","Third Party Advisory"]},{"url":"http://www.securitytracker.com/id?1022358","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-020","tags":["vendor-advisory","x_refsource_MS","x_transferred","Patch","Vendor Advisory"]},{"url":"http://www.securityfocus.com/bid/35232","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"http://www.us-cert.gov/cas/techalerts/TA09-160A.html","tags":["third-party-advisory","x_refsource_CERT","x_transferred","Third Party Advisory","US Government Resource"]},{"url":"http://www.vupen.com/english/advisories/2009/1539","tags":["vdb-entry","x_refsource_VUPEN","x_transferred","Third Party Advisory"]},{"url":"http://www.attrition.org/pipermail/vim/2009-June/002192.html","tags":["mailing-list","x_refsource_VIM","x_transferred","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-1122"},{"url":"https://github.com/advisories/GHSA-c9gf-r7p8-qf28"}],"sources":{"cve":[{"id":"CVE-2009-1122","description":"The WebDAV extension in Microsoft Internet Information Services (IIS) 5.0 on Windows 2000 SP4 does not properly decode URLs, which allows remote attackers to bypass authentication, and possibly read or create files, via a crafted HTTP request, aka \"IIS 5.0 WebDAV Authentication Bypass Vulnerability,\" a different vulnerability than CVE-2009-1535.","status":"published","published":"2009-06-10T18:00:00Z","modified":"2024-08-07T05:04:48.271Z","updated_at":"2026-11-02T14:33:25.126493Z"}],"euvd":[{"id":"EUVD-2009-1123","description":"The WebDAV extension in Microsoft Internet Information Services (IIS) 5.0 on Windows 2000 SP4 does not properly decode URLs, which allows remote attackers to bypass authentication, and possibly read or create files, via a crafted HTTP request, aka \"IIS 5.0 WebDAV Authentication Bypass Vulnerability,\" a different vulnerability than CVE-2009-1535.","status":"published","published":"2009-06-10T18:00:00Z","modified":"2024-08-07T05:04:48Z","updated_at":"2026-11-03T01:39:22.935477Z"}],"ghsa":[{"id":"GHSA-c9gf-r7p8-qf28","title":"The WebDAV extension in Microsoft Internet Information Services (IIS) 5.0 on Windows 2000 SP4...","description":"The WebDAV extension in Microsoft Internet Information Services (IIS) 5.0 on Windows 2000 SP4 does not properly decode URLs, which allows remote attackers to bypass authentication, and possibly read or create files, via a crafted HTTP request, aka \"IIS 5.0 WebDAV Authentication Bypass Vulnerability,\" a different vulnerability than CVE-2009-1535.","status":"published","published":"2022-05-02T03:21:37Z","modified":"2023-01-31T05:07:49Z","cwes":["CWE-287"],"updated_at":"2026-11-02T14:49:17.033223Z"}],"nvd":[{"id":"CVE-2009-1122","description":"The WebDAV extension in Microsoft Internet Information Services (IIS) 5.0 on Windows 2000 SP4 does not properly decode URLs, which allows remote attackers to bypass authentication, and possibly read or create files, via a crafted HTTP request, aka \"IIS 5.0 WebDAV Authentication Bypass Vulnerability,\" a different vulnerability than CVE-2009-1535.","status":"published","published":"2009-06-10T18:30:00.297Z","modified":"2026-06-16T23:06:33.32Z","cvss":[{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:01:35.733785Z"}]}}