PT-2009-6055 · Microsoft · Office Sharepoint Server 2007

Publicado 2009-10-30 · Atualizado 2018-10-10 · CVE-2009-3830

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Office SharePoint Server 2007 versions 12.0.0.4518 through 12.0.0.6219

Description The issue allows remote attackers to read ASP.NET source code. This is achieved by manipulating pathnames in the SourceUrl and Source parameters to the "/ layouts/download.aspx" API endpoint.

Recommendations For Microsoft Office SharePoint Server 2007 versions 12.0.0.4518 through 12.0.0.6219, consider restricting access to the layouts/download.aspx API endpoint until a fix is available. As a temporary workaround, avoid using the SourceUrl and Source parameters in the affected API endpoint.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2009-3830

Produtos afetados

Office Sharepoint Server 2007

Referências · 7

• 🔥 https://exploit-db.com/exploits/9967 · Exploit
• 🔥 http://securityfocus.com/bid/36817 · Exploit
• http://securityfocus.com/archive/1/507419/100/0/threaded · Nota
• http://support.microsoft.com/kb/976829 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2009-3830 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/53955 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3830 · Nota