CVE-2009-1535
- State
- Published
- Severity
- Not scored
- Published
- Jun 10, 2009
- Updated
- Aug 7, 2024
- Reserved
- May 5, 2009
Description
The WebDAV extension in Microsoft Internet Information Services (IIS) 5.1 and 6.0 allows remote attackers to bypass URI-based protection mechanisms, and list folders or read, create, or modify files, via a %c0%af (Unicode / character) at an arbitrary position in the URI, as demonstrated by inserting %c0%af into a "/protected/" initial pathname component to bypass the password protection on the protected\ folder, aka "IIS 5.1 and 6.0 WebDAV Authentication Bypass Vulnerability," a different vulnerability than CVE-2009-1122.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- oval:org.mitre.oval:def:6029vdb-entrysignature
- MS09-020vendor-advisory
- http://view.samurajdata.se/psview.php?id=023287d6&page=1
- http://isc.sans.org/diary.html?n&storyid=6397
- 20090515 IIS6 + webdav and unicode rides again in 2009mailing-list
- 20090515 Re: IIS6 + webdav and unicode rides again in 2009mailing-list
- http://blog.zoller.lu/2009/05/iis-6-webdac-auth-bypass-and-data.html
- TA09-160Athird-party-advisory
- http://archives.neohapsis.com/archives/fulldisclosure/2009-05/att-0135/IIS_Advisory.pdf
- 20090515 Re: IIS6 + webdav and unicode rides again in 2009mailing-list
- 20090616 IIS WebDav Vulnerability CVE IDmailing-list
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.