Authentication Bypass Vulnerability in Microsoft IIS Web Server 5.0

CVE-2007-2815

Summary

The 'hit-highlighting' function in webhits.dll of Microsoft IIS Web Server 5.0 is susceptible to an authentication bypass issue. This vulnerability allows remote attackers to circumvent NTLM and basic authentication mechanisms, granting unauthorized access to private web directories. The flaw arises from improper use of Windows NT ACL (Access Control List) configuration, particularly through manipulation of the CiWebhitsfile parameter. Attackers can exploit this vulnerability to access restricted content, potentially leading to data exposure.

References