VULNERABILITY INTELLIGENCE
CVE-2007-2815
CVSS score10 HIGH
EPSS probability73.35%
CISA KEVNot currently listed
Published2007-05-22
Last modified2026-06-16
CVSS vectorAV:N/AC:L/Au:N/C:C/I:C/A:C
Description
The "hit-highlighting" functionality in webhits.dll in Microsoft Internet Information Services (IIS) Web Server 5.0 only uses Windows NT ACL configuration, which allows remote attackers to bypass NTLM and basic authentication mechanisms and access private web directories via the CiWebhitsfile parameter to null.htw.