PT-2013-4204 · Microsoft · Sharepoint Server+1

Publicado 2013-09-11 · Atualizado 2018-10-12 · CVE-2013-3180

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Microsoft SharePoint Server versions 2010 SP1 through 2010 SP2 Microsoft SharePoint Server version 2013

Description The issue allows remote attackers to inject arbitrary web script or HTML via a crafted POST request. An elevation of privilege vulnerability exists, which could allow an attacker to perform cross-site scripting attacks and run script in the security context of the logged-on user.

Recommendations For Microsoft SharePoint Server versions 2010 SP1 through 2010 SP2, update to a version that includes the fix for this issue. For Microsoft SharePoint Server version 2013, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to sensitive areas of the server to minimize the risk of exploitation.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2013-3180

Produtos afetados

Sharepoint Server

Sharepoint Foundation

Referências · 7

• http://technet.microsoft.com/en-us/security/bulletin/ms13-067 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3180 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2013-3180 · Nota de Segurança
• http://us-cert.gov/ncas/alerts/TA13-253A · Nota
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-067 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3180 · Nota
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19136 · Nota