Description

The "hit-highlighting" functionality in webhits.dll in Microsoft Internet Information Services (IIS) Web Server 5.0 only uses Windows NT ACL configuration, which allows remote attackers to bypass NTLM and basic authentication mechanisms and access private web directories via the CiWebhitsfile parameter to null.htw.

Remediation

References

CVE-2007-2815

Related Vulnerabilities

Joomla! Core 3.x.x SQL Injection (3.0.0 - 3.9.22)

WordPress Plugin Funnel Builder by CartFlows-Create High Converting Sales Funnels For WordPress Privilege Escalation (1.3.0)

phpMyFAQ Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2022-4407)

Joomla Other Vulnerability (CVE-2006-3480)

SugarCRM Unrestricted Upload of File with Dangerous Type Vulnerability (CVE-2023-35808)

Severity

Critical

Classification

CVE-2007-2815 CWE-264

Tags

Missing Update Known Vulnerabilities