CVE-2007-2815

The "hit-highlighting" functionality in webhits.dll in Microsoft Internet Information Services (IIS) Web Server 5.0 only uses Windows NT ACL configuration, which allows remote attackers to bypass NTLM and basic authentication mechanisms and access private web directories via the CiWebhitsfile parameter to null.htw.

CVSS v2.0 NVD

10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C

EPSS

73.35% chance of exploitation in the next 30 days, 99th percentile

Published

2007-05-22

Updated

2024-08-07

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/4016

Security advisories

• http://www.securityfocus.com/bid/24105

References

• CVE Record
• NVD entry