Vulnerability record · CVE-2001-0151 · published 2 June 2001
CVE-2001-0151: IIS 5.0 WebDAV malformed requests cause denial of service
Microsoft · Internet Information Services
IIS 5.0 fails to handle a series of malformed WebDAV requests, allowing a remote attacker to trigger a denial of service. The flaw is a availability-only issue: no confidentiality or integrity impact is recorded, but a successful attack can take the web service down. It matters because WebDAV is commonly exposed on internet-facing IIS servers, and the record gives no affected version detail beyond IIS 5.0.
Description
IIS 5.0 allows remote attackers to cause a denial of service via a series of malformed WebDAV requests.
AV:N/AC:L/Au:N/C:N/I:N/A:P
Automated analysis
medium priorityAvailability-only denial of service with no authentication required, but the affected product is legacy and the record lacks exploit confirmation.
What it is
IIS 5.0 fails to handle a series of malformed WebDAV requests, allowing a remote attacker to trigger a denial of service. The flaw is a availability-only issue: no confidentiality or integrity impact is recorded, but a successful attack can take the web service down. It matters because WebDAV is commonly exposed on internet-facing IIS servers, and the record gives no affected version detail beyond IIS 5.0.
Impact
An attacker can disrupt or crash the IIS 5.0 WebDAV service, denying access to hosted content and applications. No data theft or modification is described in the record.
Attack surface
Reachable over the network via HTTP/WebDAV requests to the IIS 5.0 service; the CVSS vector (AV:N/AC:L/Au:N) indicates no authentication and no user interaction are required. The description does not specify which WebDAV methods or request patterns are involved.
Exploitation
Not listed in CISA KEV and no ransomware association is recorded, but EPSS is high at roughly 0.679 (99th percentile), suggesting meaningful exploitation likelihood. Reference tags are empty, so no public exploit or PoC status can be confirmed from the record.
What to do
- Apply the Microsoft security bulletin MS01-016 update for IIS 5.0, or upgrade to a supported IIS version.
- Disable WebDAV on IIS servers that do not require it.
- Restrict WebDAV access to trusted networks or authenticated users where it must remain enabled.
- Monitor and rate-limit malformed or anomalous WebDAV request patterns at the edge.
Detection
- Alert on spikes in malformed or rejected WebDAV requests in IIS logs.
- Monitor IIS worker process crashes or unexpected service restarts correlated with WebDAV traffic.
- Baseline normal WebDAV methods and flag unusual method usage or request volumes from single sources.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2001-0151 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2001-0151), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
