{"uuid": "46c5b35e-c79f-4689-a168-7c7c14bc7e96", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2009-1535", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/ms09_020_webdav_unicode_bypass.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"\", \"author\": [\"et \", \"aushack \"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": false, \"default_credential\": false, \"description\": \"This module attempts to to bypass authentication using the WebDAV IIS6\\n          Unicode vulnerability discovered by Kingcope. The vulnerability appears\\n          to be exploitable where WebDAV is enabled on the IIS6 server, and any\\n          protected folder requires either Basic, Digest or NTLM authentication.\", \"disclosure_date\": null, \"fullname\": \"auxiliary/scanner/http/ms09_020_webdav_unicode_bypass\", \"is_install_path\": true, \"mod_time\": \"2026-04-02 17:30:43 +0000\", \"name\": \"MS09-020 IIS6 WebDAV Unicode Authentication Bypass\", \"needs_cleanup\": false, \"notes\": {\"Reliability\": [\"unknown-reliability\"], \"SideEffects\": [\"unknown-side-effects\"], \"Stability\": [\"unknown-stability\"]}, \"path\": \"/modules/auxiliary/scanner/http/ms09_020_webdav_unicode_bypass.rb\", \"platform\": \"\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"scanner/http/ms09_020_webdav_unicode_bypass\", \"references\": [\"MSB-MS09-020\", \"CVE-2009-1535\", \"CVE-2009-1122\", \"OSVDB-54555\", \"BID-34993\"], \"rport\": 80, \"session_types\": false, \"targets\": null, \"type\": \"auxiliary\"}", "creation_timestamp": "2026-09-08T06:47:37.624370Z"}