PT-2012-3603 · Microsoft · Office Sharepoint Server 2007+3

Publicado 2012-07-10 · Atualizado 2018-10-12 · CVE-2012-1860

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:N/A:P

Name of the Vulnerable Software and Affected Versions Microsoft Office SharePoint Server 2007 versions SP2 through SP3 SharePoint Server 2010 versions Gold through SP1 Office Web Apps 2010 versions Gold through SP1

Description The issue allows remote authenticated users to obtain sensitive information or cause a denial of service by changing a parameter in a search-scope URL. An information disclosure vulnerability exists in the way that SharePoint stores search scopes, which could allow an attacker to view or tamper with other users' search scopes.

Recommendations For Microsoft Office SharePoint Server 2007 versions SP2 through SP3, update the permissions for search scopes to properly restrict access. For SharePoint Server 2010 versions Gold through SP1, modify the search-scope URL parameters to prevent unauthorized changes. For Office Web Apps 2010 versions Gold through SP1, restrict access to search scopes to prevent information disclosure or tampering.

Correção

DoS

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2012-1860

Produtos afetados

Office Sharepoint Server 2007

Office Web Apps 2010

Sharepoint Server 2010

Sharepoint Server

Referências · 6

• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15265 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1860 · Nota de Segurança
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-050 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2012-1860 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1860 · Nota
• http://technet.microsoft.com/en-us/security/bulletin/ms12-050 · Nota