VulnerabilityModified

CVE-2009-1122

The WebDAV extension in Microsoft Internet Information Services (IIS) 5.0 on Windows 2000 SP4 does not properly decode URLs, which allows remote attackers to bypass authentication, and possibly read or create files, via a crafted HTTP request, aka "IIS…

HIGH 7.5EPSS 98.4%

Does this matter?

EPSS puts the probability of exploitation in the next 30 days at 98.4%, higher than 100% of all known CVEs. Patch or mitigate before the next change window.

Description

CVSS 2.0: 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS: 98.45% probability · 100th percentile
CISA KEV: Not listed
Weakness: CWE-287
Affected: microsoft/internet information services
Source: secure@microsoft.com

References

http://www.attrition.org/pipermail/vim/2009-June/002192.htmlThird Party Advisory
http://www.securityfocus.com/bid/35232Third Party Advisory, VDB Entry
http://www.securitytracker.com/id?1022358Third Party Advisory, VDB Entry
http://www.us-cert.gov/cas/techalerts/TA09-160A.htmlThird Party Advisory, US Government Resource
http://www.vupen.com/english/advisories/2009/1539Third Party Advisory
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-020Patch, Vendor Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5861Third Party Advisory
http://www.attrition.org/pipermail/vim/2009-June/002192.htmlThird Party Advisory
http://www.securityfocus.com/bid/35232Third Party Advisory, VDB Entry
http://www.securitytracker.com/id?1022358Third Party Advisory, VDB Entry
http://www.us-cert.gov/cas/techalerts/TA09-160A.htmlThird Party Advisory, US Government Resource
http://www.vupen.com/english/advisories/2009/1539Third Party Advisory
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-020Patch, Vendor Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5861Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.