PT-2010-1166 · Microsoft · Sharepoint Services 3.0+1

Publicado 2010-04-29 · Atualizado 2018-10-12 · CVE-2010-0817

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Microsoft SharePoint Server 2007 versions 12.0.0.6421 and earlier Microsoft SharePoint Services 3.0 SP1 and SP2

Description The issue is related to a cross-site scripting (XSS) vulnerability that allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the cid0 parameter in the layouts/help.aspx page. The vulnerability is associated with the failure to protect the web page structure, which can lead to remote attackers performing cross-site scripting attacks.

Recommendations For Microsoft SharePoint Server 2007 versions 12.0.0.6421 and earlier, consider restricting access to the layouts/help.aspx page until a fix is available. For Microsoft SharePoint Services 3.0 SP1 and SP2, avoid using the cid0 parameter in the affected page to minimize the risk of exploitation.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

BDU:2021-04409

CVE-2010-0817

Produtos afetados

Sharepoint Server 2007

Sharepoint Services 3.0

Referências · 9

• 🔥 http://htbridge.ch/advisory/xss_in_microsoft_sharepoint_server_2007.html · Exploit
• 🔥 https://exploit-db.com/exploits/12450 · Exploit
• http://securityfocus.com/archive/1/511021/100/0/threaded · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0817 · Nota
• https://bdu.fstec.ru/vul/2021-04409 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2010-0817 · Nota de Segurança
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-039 · Aviso do Fabricante
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7468 · Nota
• http://us-cert.gov/cas/techalerts/TA10-159B.html · Nota