CVE-2009-4444

CVE-2009-4444 is a medium-severity vulnerability in Microsoft Internet Information Services with a CVSS 2.0 base score of 6.0. Its EPSS exploit-prediction score of 64% places it in the 99th percentile, indicating an elevated likelihood of exploitation.

Key facts

Description

Microsoft Internet Information Services (IIS) 5.x and 6.x uses only the portion of a filename before a ; (semicolon) character to determine the file extension, which allows remote attackers to bypass intended extension restrictions of third-party upload applications via a filename with a (1) .asp, (2) .cer, or (3) .asa first extension, followed by a semicolon and a safe extension, as demonstrated by the use of asp.dll to handle a .asp;.jpg file.

Frequently asked questions

What is CVE-2009-4444?
Microsoft Internet Information Services (IIS) 5.x and 6.x uses only the portion of a filename before a ; (semicolon) character to determine the file extension, which allows remote attackers to bypass intended extension restrictions of third-party upload applications via a filename with a (1) .asp, (2) .cer, or (3) .asa first extension, followed by a semicolon and a safe extension, as demonstrated by the use of asp.dll to handle a .asp;.jpg file.
How severe is CVE-2009-4444?
CVE-2009-4444 has a CVSS 2.0 base score of 6.0, rated medium severity.
Is CVE-2009-4444 being actively exploited?
It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 64% (99th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2009-4444?
CVE-2009-4444 primarily affects Microsoft Internet Information Services. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2009-4444?
Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2009-4444 published?
CVE-2009-4444 was published on 2009-12-29 and last updated on 2026-06-16.

References

Affected products (2)

More vulnerabilities in Microsoft Internet Information Services

All CVEs affecting Microsoft Internet Information Services →

Threat intelligence

Threat-intel indicators referencing this CVE: