Vulnerability record · CVE-2005-1989 · published 10 August 2005
CVE-2005-1989: Internet Explorer WebDAV Web Folder cross-domain flaw
Microsoft · Ie
Internet Explorer 5.0, 5.5 and 6.0 contain an unspecified vulnerability triggered when a user browses from a web site to a web folder view using WebDAV, described as a cross-domain issue. It allows a remote attacker to obtain information and possibly execute code, so it undermines the browser's origin boundary and can lead to data theft or code execution.
Description
Unknown vulnerability in Internet Explorer 5.0, 5.5, and 6.0 allows remote attackers to obtain information and possibly execute code when browsing from a web site to a web folder view using WebDAV, aka "Web Folder Behaviors Cross-Domain Vulnerability".
AV:N/AC:L/Au:N/C:P/I:P/A:P
Automated analysis
high priorityRemote unauthenticated code execution and information disclosure with a high EPSS score, though the affected IE versions are obsolete and no KEV listing exists.
What it is
Internet Explorer 5.0, 5.5 and 6.0 contain an unspecified vulnerability triggered when a user browses from a web site to a web folder view using WebDAV, described as a cross-domain issue. It allows a remote attacker to obtain information and possibly execute code, so it undermines the browser's origin boundary and can lead to data theft or code execution.
Impact
An attacker can read information across domains and potentially execute code in the context of the browsing user. That means exposure of sensitive data and possible full compromise of the client session.
Attack surface
Reached over the network through a malicious or compromised web page that leads the victim into a WebDAV web folder view; no authentication is required, but user browsing interaction is needed. The CVSS vector AV:N/AC:L/Au:N confirms remote, unauthenticated, low-complexity access.
Exploitation
Not listed in CISA KEV and no ransomware associations are recorded, so there is no confirmed in-the-wild exploitation in this record. EPSS is high (0.45679, 98.7th percentile), indicating elevated predicted likelihood, and a vendor patch reference exists.
What to do
- Apply the Microsoft security update MS05-038 for Internet Explorer immediately.
- Upgrade to a supported, modern browser; IE 5.0, 5.5 and 6.0 are long out of support.
- Disable or restrict WebDAV and web folder view functionality where it is not required.
- Enforce network controls that block untrusted WebDAV traffic and restrict browsing to trusted sites.
- Isolate legacy IE use in tightly controlled environments if it cannot be removed.
Detection
- Monitor proxy and web logs for WebDAV methods (PROPFIND, OPTIONS) and web folder view requests from client systems.
- Alert on IE processes making unexpected outbound WebDAV connections to untrusted hosts.
- Review endpoint logs for suspicious child processes or file writes originating from Internet Explorer sessions.
- Hunt for access to known malicious or newly registered domains serving WebDAV content to legacy IE clients.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2005-1989 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2005-1989), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.
