CVE-2009-1122 in the critical feed json
The WebDAV extension in Microsoft Internet Information Services (IIS) 5.0 on Windows 2000 SP4 does not properly decode URLs, which allows r…
published 2009-06-10 17 y ago modified 2026-06-16 4 mo ago also EUVD-2009-1123
- cvss
- 7.5
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 98.4%
- EPSS 98.4% chance of exploitation in 30 days, percentile 99.9%
- public exploits
- 3
- Metasploit, Exploit-DB
Summary
The WebDAV extension in Microsoft Internet Information Services (IIS) 5.0 on Windows 2000 SP4 does not properly decode URLs, which allows remote attackers to bypass authentication, and possibly read or create files, via a crafted HTTP request, aka "IIS 5.0 WebDAV Authentication Bypass Vulnerability," a different vulnerability than CVE-2009-1535.
Patch / fix
Timeline
- First public exploit (EDB-8806)
- Published
Exploit prediction
98.45% chance of exploitation in the next 30 days, higher than 99.9% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Metasploit auxiliary/scanner/http/dir_webdav_unicode_bypass MS09-020 IIS6 WebDAV Unicode Auth Bypass Directory Scanner metasploit auxiliary, normal rank
- Metasploit auxiliary/scanner/http/ms09_020_webdav_unicode_bypass MS09-020 IIS6 WebDAV Unicode Authentication Bypass metasploit auxiliary, normal rank
- EDB-8806 Microsoft IIS 6.0 - WebDAV Remote Authentication Bypass (2) remote, 2009-05-26
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Classification
- Weakness
-
- CWE-287 Improper Authentication
References
-
docs.microsoft.com
/en-us/security-updates/securitybulletins/2009/ms09-020
vendor-advisory, patch
-
oval.cisecurity.org
/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5861
vdb-entry, signature, third-party-advisory
-
securitytracker.com
/id?1022358
vdb-entry, third-party-advisory
-
securityfocus.com
/bid/35232
vdb-entry, third-party-advisory
-
us-cert.gov
/cas/techalerts/TA09-160A.html
third-party-advisory, us-government-resource
-
vupen.com
/english/advisories/2009/1539
vdb-entry, third-party-advisory
-
attrition.org
/pipermail/vim/2009-June/002192.html
mailing-list, third-party-advisory
Sources
- CVE List CVE-2009-1122
- NVD CVE-2009-1122
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.