CVE-2007-2815

no score yetEPSS 73%

microsoft internet information services: no CVSS score yet. EPSS 73% chance of exploitation in the next 30 days.

The "hit-highlighting" functionality in webhits.dll in Microsoft Internet Information Services (IIS) Web Server 5.0 only uses Windows NT ACL configuration, which allows remote attackers to bypass NTLM and basic authentication mechanisms and access private web directories via the CiWebhitsfile parameter to null.htw.

EPSS: 73% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
CWE: CWE-264
Published: 2007-05-22
Modified: 2026-06-16
Record from: the NVD, synced 2026-10-19

Affected

microsoft:internet_information_services

References

http://osvdb.org/41091
http://securityreason.com/securityalert/2725
http://support.microsoft.com/kb/328832
http://www.securityfocus.com/archive/1/469238/100/0/threaded
http://www.securityfocus.com/bid/24105

Check your stack JSON