CVE-2007-2815

published 2007-05-22

CVE-2007-2815: The "hit-highlighting" functionality in webhits.dll in Microsoft Internet Information Services (IIS) Web Server 5.0 only uses Windows NT ACL configuration…

critical 10 CVSS 3.1

AV N AC L Au N C C I C A C

EXPLOIT

The "hit-highlighting" functionality in webhits.dll in Microsoft Internet Information Services (IIS) Web Server 5.0 only uses Windows NT ACL configuration, which allows remote attackers to bypass NTLM and basic authentication mechanisms and access private web directories via the CiWebhitsfile parameter to null.htw.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
microsoft	internet_information_services	—	—

CWE-264