Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
The "hit-highlighting" functionality in webhits.dll in Microsoft Internet Information Services (IIS) Web Server 5.0 only uses Windows NT ACL configuration, which allows remote attackers to bypass NTLM and basic authentication mechanisms and access private web directories via the CiWebhitsfile parameter to null.htw.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
Microsoft IIS Hit Highlighting功能绕过访问认证漏洞
Vulnerability Description
Microsoft IIS是Microsoft Windows自带的一个网络信息服务器，其中包含HTTP服务功能。 Microsoft IIS在处理访问认证存在漏洞，远程攻击者可能利用此漏洞非授权访问文件。 IIS的Webhits.dll中所提供的Hit-highlighting功能仅依赖于Microsoft Windows NT ACL配置而不依赖于ISS认证配置。如果匿名用户能够通过恶意的URL请求向null.htw对象传送CiWebhitsfile参数的话，Hit-highlighting就可能返回
CVSS Information
N/A
Vulnerability Type
N/A