The "hit-highlighting" functionality in webhits.dll in Microsoft Internet Information Services (IIS) Web Server 5.0 only uses Windows NT ACL configuration, which allows remote attackers to bypass NTLM and basic authentication mechanisms and access private web directories via the CiWebhitsfile parameter to null.htw.
References
Configurations
History
No history.
Information
Published : 2007-05-22 19:30
Updated : 2024-02-28 11:01
NVD link : CVE-2007-2815
Mitre link : CVE-2007-2815
CVE.ORG link : CVE-2007-2815
JSON object : View
Products Affected
microsoft
- internet_information_services
CWE
CWE-264
Permissions, Privileges, and Access Controls