CVE-2009-1122

Опубликовано: 10 июн. 2009

Источник: nvd

CVSS2: 7.5

EPSS Критический

Описание

The WebDAV extension in Microsoft Internet Information Services (IIS) 5.0 on Windows 2000 SP4 does not properly decode URLs, which allows remote attackers to bypass authentication, and possibly read or create files, via a crafted HTTP request, aka "IIS 5.0 WebDAV Authentication Bypass Vulnerability," a different vulnerability than CVE-2009-1535.

Ссылки

http://www.attrition.org/pipermail/vim/2009-June/002192.html
Third Party Advisory
http://www.securityfocus.com/bid/35232
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id?1022358
Third Party Advisory
VDB Entry
http://www.us-cert.gov/cas/techalerts/TA09-160A.html
Third Party Advisory
US Government Resource
http://www.vupen.com/english/advisories/2009/1539
Third Party Advisory
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-020
Patch
Vendor Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5861
Third Party Advisory
http://www.attrition.org/pipermail/vim/2009-June/002192.html
Third Party Advisory
http://www.securityfocus.com/bid/35232
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id?1022358
Third Party Advisory
VDB Entry
http://www.us-cert.gov/cas/techalerts/TA09-160A.html
Third Party Advisory
US Government Resource
http://www.vupen.com/english/advisories/2009/1539
Third Party Advisory
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-020
Patch
Vendor Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5861
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:a:microsoft:internet_information_services:5.0:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_2000:-:sp4:*:*:*:*:*:*

EPSS

Процентиль: 100%

0.92339

Критический

7.5 High

CVSS2

Дефекты

CWE-287

Связанные уязвимости

GHSA-c9gf-r7p8-qf28

github

почти 4 года назад