CVE-2007-2815

Severity: critical (CVSS 10.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 73.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2007-05-22 · updated 2026-06-16
Weakness: CWE-264

Description

The "hit-highlighting" functionality in webhits.dll in Microsoft Internet Information Services (IIS) Web Server 5.0 only uses Windows NT ACL configuration, which allows remote attackers to bypass NTLM and basic authentication mechanisms and access private web directories via the CiWebhitsfile parameter to null.htw.

Affected products

Microsoft IIS: 5.0

References

http://osvdb.org/41091
http://securityreason.com/securityalert/2725
http://support.microsoft.com/kb/328832
http://www.securityfocus.com/archive/1/469238/100/0/threaded
http://www.securityfocus.com/bid/24105
http://osvdb.org/41091
http://securityreason.com/securityalert/2725
http://support.microsoft.com/kb/328832
http://www.securityfocus.com/archive/1/469238/100/0/threaded
http://www.securityfocus.com/bid/24105

Get alerted when CVE-2007-2815 or the next vulnerability affects your stack