PT-2010-1169 · Microsoft · Forefront Unified Access Gateway

Eyal Gruner · Publicado 2010-11-09 · Atualizado 2018-10-12 · CVE-2010-3936

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Forefront Unified Access Gateway versions 2010 Gold, 2010 Update 1, and 2010 Update 2

Description The issue is related to a lack of protection for the web page structure in the Signurl.asp component. This allows a remote attacker to perform cross-site scripting (XSS) attacks, which can enable the injection of arbitrary web scripts or HTML.

Recommendations For Microsoft Forefront Unified Access Gateway versions 2010 Gold, 2010 Update 1, and 2010 Update 2, consider restricting access to the Signurl.asp component until a patch is available. As a temporary workaround, avoid using the Signurl.asp component in sensitive operations to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

BDU:2021-04412

CVE-2010-3936

Produtos afetados

Forefront Unified Access Gateway

Referências · 5

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-089 · Aviso do Fabricante
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12218 · Nota
• https://bdu.fstec.ru/vul/2021-04412 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2010-3936 · Nota de Segurança
• http://us-cert.gov/cas/techalerts/TA10-313A.html · Nota