CVE-2007-2815 The "hit-highlighting" functionality in webhits.dll in Microsoft Internet Information Services (IIS) Web Server 5.0 only uses Windows NT ACL configuration, which allows remote attackers to bypass NTLM...
HighCVSS 10.0
EPSS 73.4%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
The "hit-highlighting" functionality in webhits.dll in Microsoft Internet Information Services (IIS) Web Server 5.0 only uses Windows NT ACL configuration, which allows remote attackers to bypass NTLM and basic authentication mechanisms and access private web directories via the CiWebhitsfile parameter to null.htw.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft internet information services | = 5.0 | No fix listed |
References
- 41091 vdb-entry
- 2725 third-party-advisory
- 328832 vendor-advisory
- 20070522 [ISecAuditors Security Advisories] Microsoft IIS5 NTLM and Basic authentication bypass mailing-list
- 24105 vdb-entry