PT-2012-2243 · Microsoft · Sharepoint Foundation 2010+1

Publicado 2012-02-14 · Atualizado 2018-10-12 · CVE-2012-0017

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Microsoft SharePoint Foundation 2010 Gold and SP1

Description A cross-site scripting issue exists, allowing remote attackers to inject arbitrary web script or HTML via JavaScript sequences in a URL. This could result in information disclosure or elevation of privilege if a user clicks a specially crafted URL containing malicious JavaScript elements. When the malicious JavaScript is echoed back to the user's browser, the resulting page could allow an attacker to issue SharePoint commands in the context of the authenticated user on the targeted SharePoint site.

Recommendations For Microsoft SharePoint Foundation 2010 Gold and SP1, consider disabling access to the inplview.aspx page until a patch is available. Restrict access to URLs that may contain malicious JavaScript elements to minimize the risk of exploitation. Avoid using URLs with JavaScript sequences in Microsoft SharePoint 2010 until the issue is resolved.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2012-0017

Produtos afetados

Sharepoint Foundation 2010

Sharepoint Foundation

Referências · 6

• http://technet.microsoft.com/en-us/security/bulletin/ms12-011 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-0017 · Nota de Segurança
• http://us-cert.gov/cas/techalerts/TA12-045A.html · Nota
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14637 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0017 · Nota de Segurança
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-011 · Aviso do Fabricante