10.0crit
CVE-2007-2815in critical feed1 exploit
The "hit-highlighting" functionality in webhits.dll in Microsoft Internet Information Services (IIS) Web Server 5.0 only uses Windows NT AC…
Published 19 y ago · modified 4 mo ago · JSON
CVSS
10.0
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
73.4%
percentile 99%
Public exploits
1
Exploit-DB
Summary
The "hit-highlighting" functionality in webhits.dll in Microsoft Internet Information Services (IIS) Web Server 5.0 only uses Windows NT ACL configuration, which allows remote attackers to bypass NTLM and basic authentication mechanisms and access private web directories via the CiWebhitsfile parameter to null.htw.
Exploit prediction (EPSS)
73.35% probability of exploitation in the next 30 days, higher than 99% of all scored CVEs.
Exploits and detections
- EDB-4016 Microsoft IIS 5.1 - Hit Highlighting Authentication Bypass · remote · 2007-05-31
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 2.0 | 10.0 | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Classification
- Weakness
- CWE-264 Permissions, Privileges, and Access Controls
References
- osvdb.org /41091 · vdb-entry, x_refsource_OSVDB, x_transferred
- securityreason.com /securityalert/2725 · third-party-advisory, x_refsource_SREASON, x_transferred
- securityfocus.com /archive/1/469238/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
- securityfocus.com /bid/24105 · vdb-entry, x_refsource_BID, x_transferred
- support.microsoft.com /kb/328832 · vendor-advisory, x_refsource_MSKB, x_transferred
Sources
- CVE List: CVE-2007-2815
- NVD: CVE-2007-2815
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.