CVE-2009-1535
CVE-2009-1535 is a high-severity vulnerability in Microsoft Internet Information Services with a CVSS 2.0 base score of 7.5. Its EPSS exploit-prediction score of 98% places it in the 100th percentile, indicating an elevated likelihood of exploitation. The underlying weakness is classified as CWE-287.
Key facts
- Severity: High (CVSS 2.0 base score 7.5)
- EPSS exploit prediction: 98% (100th percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-287
- Affected product: Microsoft Internet Information Services
- Published:
- Last modified:
Description
The WebDAV extension in Microsoft Internet Information Services (IIS) 5.1 and 6.0 allows remote attackers to bypass URI-based protection mechanisms, and list folders or read, create, or modify files, via a %c0%af (Unicode / character) at an arbitrary position in the URI, as demonstrated by inserting %c0%af into a "/protected/" initial pathname component to bypass the password protection on the protected\ folder, aka "IIS 5.1 and 6.0 WebDAV Authentication Bypass Vulnerability," a different vulnerability than CVE-2009-1122.
Frequently asked questions
- What is CVE-2009-1535?
- The WebDAV extension in Microsoft Internet Information Services (IIS) 5.1 and 6.0 allows remote attackers to bypass URI-based protection mechanisms, and list folders or read, create, or modify files, via a %c0%af (Unicode / character) at an arbitrary position in the URI, as demonstrated by inserting %c0%af into a "/protected/" initial pathname component to bypass the password protection on the protected\ folder, aka "IIS 5.1 and 6.0 WebDAV Authentication Bypass Vulnerability," a different vulnerability than CVE-2009-1122.
- How severe is CVE-2009-1535?
- CVE-2009-1535 has a CVSS 2.0 base score of 7.5, rated high severity.
- Is CVE-2009-1535 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 98% (100th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2009-1535?
- CVE-2009-1535 primarily affects Microsoft Internet Information Services. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
- How do I fix CVE-2009-1535?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
- When was CVE-2009-1535 published?
- CVE-2009-1535 was published on 2009-06-10 and last updated on 2026-06-16.
References
- http://archives.neohapsis.com/archives/fulldisclosure/2009-05/0135.html
- http://archives.neohapsis.com/archives/fulldisclosure/2009-05/0139.html
- http://archives.neohapsis.com/archives/fulldisclosure/2009-05/0144.html
- http://archives.neohapsis.com/archives/fulldisclosure/2009-05/att-0135/IIS_Advisory.pdf
- http://blog.zoller.lu/2009/05/iis-6-webdac-auth-bypass-and-data.html
- http://isc.sans.org/diary.html?n&storyid=6397
- http://view.samurajdata.se/psview.php?id=023287d6&page=1
- http://www.attrition.org/pipermail/vim/2009-June/002192.html
- http://www.us-cert.gov/cas/techalerts/TA09-160A.html
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-020
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6029
Affected products (2)
- cpe:2.3:a:microsoft:internet_information_services:5.1:*:*:*:*:*:*:*
- cpe:2.3:a:microsoft:internet_information_services:6.0:*:*:*:*:*:*:*
More vulnerabilities in Microsoft Internet Information Services
- CVE-2010-3972 — Critical (CVSS 10.0): Heap-based buffer overflow in the TELNET_STREAM_CONTEXT::OnSendData function in ftpsvc.dll in Microsoft FTP Service 7.0…
- CVE-2008-4301 — Critical (CVSS 10.0): A certain ActiveX control in iisext.dll in Microsoft Internet Information Services (IIS) allows remote attackers to set…
- CVE-2007-2815 — Critical (CVSS 10.0): The "hit-highlighting" functionality in webhits.dll in Microsoft Internet Information Services (IIS) Web Server 5.0…
- CVE-2003-0224 — Critical (CVSS 10.0): Buffer overflow in ssinc.dll for Microsoft Internet Information Services (IIS) 5.0 allows local users to execute…
- CVE-1999-0233 — Critical (CVSS 10.0): IIS 1.0 allows users to execute arbitrary commands using .bat or .cmd files.
- CVE-2017-7269 — Critical (CVSS 9.8): Buffer overflow in the ScStoragePathFromUrl function in the WebDAV service in Internet Information Services (IIS) 6.0…
All CVEs affecting Microsoft Internet Information Services →
Other CWE-287 (Improper Authentication) vulnerabilities
- CVE-2026-45480 — Critical (CVSS 10.0): Improper authentication in Azure Active Directory allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-46389 — Critical (CVSS 10.0): UDS Identity Config builds the Keycloak configuration image (realm, plugins, theme, truststore, JARs) consumed by UDS…
- CVE-2026-10611 — Critical (CVSS 10.0): An authentication bypass vulnerability exists in MISP when LDAP mixed authentication is enabled with OTP enforcement.…
- CVE-2026-47280 — Critical (CVSS 10.0): Improper authentication in Azure Resource Manager (ARM) allows an unauthorized attacker to elevate privileges over a…
- CVE-2026-42822 — Critical (CVSS 10.0): Improper authentication in Azure Local Disconnected Operations allows an unauthorized attacker to elevate privileges…
- CVE-2026-20182 — Critical (CVSS 10.0): May 2026: This security advisory provides the details and fix information for a vulnerability that was discovered and…
Browse all CWE-287 (Improper Authentication) vulnerabilities →
Threat intelligence
Threat-intel indicators referencing this CVE:
- 200.71.154.142 (ipv4-addr)
- 190.111.226.20 (ipv4-addr)