Servers and applications
CVE-2007-2815
The "hit-highlighting" functionality in webhits.dll in Microsoft Internet Information Services (IIS) Web Server 5.0 only uses Windows NT ACL configuration, which allows remote attackers to bypass NTLM and basic authentication mechanisms and access private web directories via the CiWebhitsfile parameter to null.htw.
- Severity
- High 10.0
- Published
- 22 May 2007
- Last changed
- 16 Jun 2026
- Added to UpHeron
- 21 Oct 2026
- Exploit chance
- 73% in the next 30 daysHigher than 99% of CVEs. EPSS by FIRST, 12 Nov 2026
- Weakness
- CWE-264
- Attack
- Over the network · No login needed
- Attacker can
- Read data · Change data · Take it down
- CVSS vector
AV:N/AC:L/Au:N/C:C/I:C/A:C- Sources
- NVD
Affected software
| Software | Affected versions |
|---|---|
Microsoft IISServers and applications · cpe:a:microsoft:internet_information_services |
|