PT-2010-2962 · Microsoft · Office Infopath+4

Chris Weber · Publicado 2010-06-08 · Atualizado 2023-12-07 · CVE-2010-1257

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Office InfoPath versions 2003 SP3 through 2007 SP2 Office SharePoint Server versions 2007 SP1 through 2007 SP2 SharePoint Services versions 3.0 SP1 through 3.0 SP2 Internet Explorer version 8

Description The issue is related to a cross-site scripting (XSS) vulnerability in the toStaticHTML API. This vulnerability allows remote attackers to inject arbitrary web script or HTML via vectors related to sanitization, potentially leading to information disclosure. An attacker could exploit this vulnerability by constructing a specially crafted Web page, allowing the attacker to execute script in the user's security context against a site that is using the toStaticHTML API.

Recommendations For Microsoft Office InfoPath versions 2003 SP3 through 2007 SP2, consider disabling the toStaticHTML API until a patch is available. For Office SharePoint Server versions 2007 SP1 through 2007 SP2, restrict access to the toStaticHTML API to minimize the risk of exploitation. For SharePoint Services versions 3.0 SP1 through 3.0 SP2, avoid using the toStaticHTML API in sensitive operations until the issue is resolved. For Internet Explorer version 8, as a temporary workaround, consider disabling the toStaticHTML() function until a patch is available.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2010-1257

Produtos afetados

Internet Explorer

Office Infopath

Office Sharepoint Server

Sharepoint Services

Sharepoint Server

Referências · 12

• http://support.avaya.com/css/P8/documents/100089747 · Nota
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-035 · Aviso do Fabricante
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-039 · Aviso do Fabricante
• https://docs.microsoft.com/security-updates/securitybulletins/2010/MS10-035 · Nota
• http://us-cert.gov/cas/techalerts/TA10-159B.html · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/58866 · Nota
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6677 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1257 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-1257 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1257 · Nota de Segurança
• https://docs.microsoft.com/security-updates/securitybulletins/2010/MS10-039 · Nota
• http://securityfocus.com/bid/40409 · Nota