CVE-2007-2815

Description

The "hit-highlighting" functionality in webhits.dll in Microsoft Internet Information Services (IIS) Web Server 5.0 only uses Windows NT ACL configuration, which allows remote attackers to bypass NTLM and basic authentication mechanisms and access private web directories via the CiWebhitsfile parameter to null.htw.

References

http://www.securityfocus.com/bid/24105

http://www.securityfocus.com/archive/1/469238/100/0/threaded

http://support.microsoft.com/kb/328832

http://securityreason.com/securityalert/2725

http://osvdb.org/41091

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3