Vulnerability Details : CVE-2009-1122

Public exploit exists!
The WebDAV extension in Microsoft Internet Information Services (IIS) 5.0 on Windows 2000 SP4 does not properly decode URLs, which allows remote attackers to bypass authentication, and possibly read or create files, via a crafted HTTP request, aka "IIS 5.0 WebDAV Authentication Bypass Vulnerability," a different vulnerability than CVE-2009-1535.
Published 2009-06-10 18:30:00
Updated 2020-11-23 20:06:44
Source Microsoft Corporation
View at NVD,   CVE.org
Vulnerability category: BypassGain privilege

Products affected by CVE-2009-1122

Exploit prediction scoring system (EPSS) score for CVE-2009-1122

EPSS FAQ
21.16%
Probability of exploitation activity in the next 30 days EPSS Score History
~ 96 %
Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2009-1122

  • MS09-020 IIS6 WebDAV Unicode Auth Bypass Directory Scanner
    First seen: 2020-04-26
    auxiliary/scanner/http/dir_webdav_unicode_bypass
    This module is based on et's HTTP Directory Scanner module, with one exception. Where authentication is required, it attempts to bypass authentication using the WebDAV IIS6 Unicode vulnerability discovered by Kingcope. The vulnerability appears to be exploitable
  • MS09-020 IIS6 WebDAV Unicode Authentication Bypass
    First seen: 2020-04-26
    auxiliary/scanner/http/ms09_020_webdav_unicode_bypass
    This module attempts to to bypass authentication using the WebDAV IIS6 Unicode vulnerability discovered by Kingcope. The vulnerability appears to be exploitable where WebDAV is enabled on the IIS6 server, and any protected folder requires either Basic, Digest or NTLM

CVSS scores for CVE-2009-1122

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Score Source First Seen
7.5
 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P
10.0
6.4
 NIST

CWE ids for CVE-2009-1122

  • When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
    Assigned by: nvd@nist.gov (Primary)

References for CVE-2009-1122

Jump to
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!
Accept Close