CVEvulnerability
CVE-2007-2815
10.0 HIGH
Official page ↗
- Status
- Modified
- Published
- 2007-05-22
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C
- Weaknesses
- CWE-264
Description
The "hit-highlighting" functionality in webhits.dll in Microsoft Internet Information Services (IIS) Web Server 5.0 only uses Windows NT ACL configuration, which allows remote attackers to bypass NTLM and basic authentication mechanisms and access private web directories via the CiWebhitsfile parameter to null.htw.
Affected configurations
• microsoft internet information services 5.0
Related
Weakness · not in database (1)
References
- http://osvdb.org/41091 osvdb.org
- http://securityreason.com/securityalert/2725 securityreason.com
- http://support.microsoft.com/kb/328832 support.microsoft.com
- http://www.securityfocus.com/archive/1/469238/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/24105 www.securityfocus.com
- http://osvdb.org/41091 osvdb.org
- http://securityreason.com/securityalert/2725 securityreason.com
- http://support.microsoft.com/kb/328832 support.microsoft.com
- http://www.securityfocus.com/archive/1/469238/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/24105 www.securityfocus.com