PT-2012-3606 · Microsoft · Windows Sharepoint Services 3.0+4
Publicado
2012-07-10
·
Atualizado
2018-10-12
·
CVE-2012-1863
CVSS v2.0
4.3
Média
| Vetor | AV:N/AC:M/Au:N/C:N/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
Microsoft Office SharePoint Server 2007 versions SP2 through SP3
Windows SharePoint Services 3.0 version SP2
SharePoint Foundation 2010 versions Gold through SP1
Description
A cross-site scripting issue exists, allowing remote attackers to inject arbitrary web script or HTML via crafted JavaScript elements in a URL. This enables attacker-controlled JavaScript to run in the context of the user clicking a link, potentially allowing an anonymous attacker to issue SharePoint commands in the context of an authenticated user.
Recommendations
For Microsoft Office SharePoint Server 2007 versions SP2 through SP3, update to a newer version to mitigate the risk.
For Windows SharePoint Services 3.0 version SP2, update to a newer version to mitigate the risk.
For SharePoint Foundation 2010 versions Gold through SP1, update to a newer version to mitigate the risk.
As a temporary workaround, consider restricting access to crafted JavaScript elements in URLs to minimize the risk of exploitation.
Correção
XSS
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Office Sharepoint Server 2007
Sharepoint Foundation 2010
Sharepoint Foundation
Sharepoint Server
Windows Sharepoint Services 3.0