CVE-2007-2815: Critical severity Microsoft Internet Information Services vulnerability
The "hit-highlighting" functionality in webhits.dll in Microsoft Internet Information Services (IIS) Web Server 5.0 only uses Windows NT ACL configuration, which allows remote attackers to bypass NTLM and basic authentication mechanisms and access private web directories via the CiWebhitsfile parameter to null.htw.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2007-2815?
CVE-2007-2815 is classified as a medium severity vulnerability that can allow unauthorized access to private web directories.
How do I fix CVE-2007-2815?
To remediate CVE-2007-2815, ensure that proper access controls are enforced and consider applying security patches or upgrading from IIS 5.0.
What software is affected by CVE-2007-2815?
CVE-2007-2815 specifically affects Microsoft Internet Information Services version 5.0.
Can CVE-2007-2815 be exploited remotely?
Yes, CVE-2007-2815 can be exploited remotely by attackers to bypass authentication mechanisms.
What attack vectors exist for CVE-2007-2815?
Attack vectors for CVE-2007-2815 typically involve manipulating the CiWebhitsfile parameter to access restricted resources.