Vulnerability in EPiServer.Forms

Try our conversational search powered by Generative AI!

Dmytro Duk
Oct 24, 2011
(1 votes)

Solving issue "405.0 - Method Not Allowed" when accessing WebDAV folder


Using EPiServer WebDAV you can face the following issue: after setting up WebDAV in EPiServer CMS and client configuration you still cannot access your web folder. Depending on client software you can get different error messages. Windows explorer says that it could not access your resource and suggests to check name spelling. Other clients return errors “Login failed” or something like “Directory listing denied”.


To get more details you can enable server side logging for EPiServer WebDAV:

<?xml version="1.0" encoding="utf-8"?>
  <appender name="OutputDebugStringAppender" type="log4net.Appender.OutputDebugStringAppender">
    <layout type="log4net.Layout.PatternLayout">
      <conversionPattern value="%date [%thread] %-5level %type.%method - %message%newline" />
  <logger name="EPiServer.WebDav" additivity="false">
    <level value="Debug" />
    <appender-ref ref="OutputDebugStringAppender" />

DAV Explorer can be used to get detailed log with all sent and received messages on client side.

In my case it turned out that EPiServer.WebDAV.Handler was processing only first OPTIONS requests.

Second request PROPFIND didn’t reach our handler. In respond to PROPFIND client got “405 Method Not Allowed” response from module named WebDAVModule. And this was the cause of the problem.


WebDAVModule intercepts WebDAV requests so they are not processed by EPiServer.WebDAV handler. Most likely it is not registered in your site config file. You can find it in Modules list for your web site in IIS Manager.

This is native IIS module, on my IIS it is enabled by default on each new web site.


Remove native WebDAVModule module if you don’t use it:

      <remove name="WebDAVModule" />

After this EPiServer.WebDAV.Handler should be able to process all corresponding requests. WebDAV configuration guide is updated with this information.

Oct 24, 2011


Please login to comment.
Latest blogs
Stop Managing Humans in Your CMS

Too many times, a content management system becomes a people management system. Meaning, an organization uses the CMS to manage all the information...

Deane Barker | Nov 30, 2023

A day in the life of an Optimizely Developer - Optimizely CMS 12: The advantages and considerations when exploring an upgrade

GRAHAM CARR - LEAD .NET DEVELOPER, 28 Nov 2023 In 2022, Optimizely released CMS 12 as part of its ongoing evolution of the platform to help provide...

Graham Carr | Nov 28, 2023

A day in the life of an Optimizely Developer - OptiUKNorth Meetup January 2024

It's time for another UK North Optimizely meet up! After the success of the last one, Ibrar Hussain (26) and Paul Gruffydd (Kin + Carta) will be...

Graham Carr | Nov 28, 2023

Publish content to Optimizely CMS using a custom GPT from OpenAI 🤖

Do you find the traditional editor interface complicated and cluttered? Would you like an editorial AI assistant you can chat with? You can!

Tomas Hensrud Gulla | Nov 28, 2023 | Syndicated blog