CVE-2009-1122

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

The WebDAV extension in Microsoft Internet Information Services (IIS) 5.0 on Windows 2000 SP4 does not properly decode URLs, which allows remote attackers to bypass authentication, and possibly read or create files, via a crafted HTTP request, aka "IIS 5.0 WebDAV Authentication Bypass Vulnerability," a different vulnerability than CVE-2009-1535.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.attrition.org/pipermail/vim/2009-June/002192.htmlThird Party Advisory
http://www.securityfocus.com/bid/35232Third Party Advisory, VDB Entry
http://www.securitytracker.com/id?1022358Third Party Advisory, VDB Entry
http://www.us-cert.gov/cas/techalerts/TA09-160A.htmlThird Party Advisory, US Government Resource
http://www.vupen.com/english/advisories/2009/1539Third Party Advisory
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-020Patch, Vendor Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5861Third Party Advisory
http://www.attrition.org/pipermail/vim/2009-June/002192.htmlThird Party Advisory
http://www.securityfocus.com/bid/35232Third Party Advisory, VDB Entry
http://www.securitytracker.com/id?1022358Third Party Advisory, VDB Entry
http://www.us-cert.gov/cas/techalerts/TA09-160A.htmlThird Party Advisory, US Government Resource
http://www.vupen.com/english/advisories/2009/1539Third Party Advisory
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-020Patch, Vendor Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5861Third Party Advisory

Timeline

Published: Jun 10, 2009
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2009

CVE-2009-11237.8The kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 SP2 does not properly v CVE-2009-11247.2The kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 SP2 does not properly v CVE-2009-11257.2The kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 SP2 does not properly v CVE-2009-11267.2The kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2 does not properly validate the user-mode input associated with CVE-2009-11277.2win32k.sys in the kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and CVE-2009-11289.3Microsoft Office PowerPoint 2000 SP3, 2002 SP3, and 2003 SP3 allows remote attackers to execute arbitrary code via crafted sound data in a f CVE-2009-11299.3Multiple stack-based buffer overflows in the PowerPoint 95 importer (PP7X32.DLL) in Microsoft Office PowerPoint 2000 SP3, 2002 SP3, and 2003 CVE-2009-11309.3Heap-based buffer overflow in Microsoft Office PowerPoint 2002 SP3 and 2003 SP3, and PowerPoint in Microsoft Office 2004 for Mac, allows rem CVE-2009-11319.3Multiple stack-based buffer overflows in Microsoft Office PowerPoint 2000 SP3 allow remote attackers to execute arbitrary code via a large a CVE-2009-11329.3Heap-based buffer overflow in the Wireless LAN AutoConfig Service (aka Wlansvc) in Microsoft Windows Vista Gold, SP1, and SP2 and Server 200 CVE-2009-11339.3Heap-based buffer overflow in Microsoft Remote Desktop Connection (formerly Terminal Services Client) running RDP 5.0 through 6.1 on Windows CVE-2009-11349.3Excel in 2007 Microsoft Office System SP1 and SP2; Microsoft Office Excel Viewer; and Microsoft Office Compatibility Pack for Word, Excel, a