CVE-2007-2815

Published: May 22, 2007Modified: Apr 23, 2026

10.0

Vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability: 10.0 / Impact: 10.0

Source: NVD

Description

The "hit-highlighting" functionality in webhits.dll in Microsoft Internet Information Services (IIS) Web Server 5.0 only uses Windows NT ACL configuration, which allows remote attackers to bypass NTLM and basic authentication mechanisms and access private web directories via the CiWebhitsfile parameter to null.htw.

Affected (1)

Products: Microsoft: Internet Information Services

1 product

Internet Information Services

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Microsoft Internet Information Services	Version 5.0

Related CWEs

References (10)

http://osvdb.org/41091

Source: cve@mitre.org

http://securityreason.com/securityalert/2725

Source: cve@mitre.org

http://support.microsoft.com/kb/328832

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/469238/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/bid/24105

Source: cve@mitre.org

http://osvdb.org/41091

Source: af854a3a-2127-422b-91ae-364da2661108

http://securityreason.com/securityalert/2725

Source: af854a3a-2127-422b-91ae-364da2661108

http://support.microsoft.com/kb/328832

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/archive/1/469238/100/0/threaded

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/24105

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.