A vulnerability has been identified in Microsoft Internet Information Services (IIS), which could allow remote attackers to bypass security restrictions and gain knowledge of sensitive information. This issue is caused by an input validation error in WebDav that fails to verify credentials before accessing password-protected resources when handling HTTP GET or PROPFIND requests containig a Unicode-encoded character (e.g. the slash character as "%c0%af") with a "Translate: f" header, which could allow remote attackers to gain unauthorized read and upload access to protected folders without providing authentication credentials.
