PT-2013-4725 · Microsoft · Sharepoint Server 2007+2

Publicado 2013-10-09 · Atualizado 2018-10-12 · CVE-2013-3895

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Microsoft SharePoint Server 2007 SP3 Microsoft SharePoint Server 2010 SP1 Microsoft SharePoint Server 2010 SP2

Description The issue allows remote attackers to conduct clickjacking attacks via a crafted web page. An elevation of privilege vulnerability exists, which could allow an attacker to perform cross-site scripting attacks and run script in the security context of the logged-on user.

Recommendations For Microsoft SharePoint Server 2007 SP3, update to a version that includes the fix for this issue. For Microsoft SharePoint Server 2010 SP1, update to a version that includes the fix for this issue. For Microsoft SharePoint Server 2010 SP2, update to a version that includes the fix for this issue.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2013-3895

Produtos afetados

Sharepoint Server 2007

Sharepoint Server 2010

Sharepoint Foundation

Referências · 8

• http://blogs.technet.com/b/srd/archive/2013/10/08/assessing-risk-for-the-october-2013-security-updates.aspx · Aviso do Fabricante
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-084 · Aviso do Fabricante
• http://us-cert.gov/ncas/alerts/TA13-288A · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3895 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-3895 · Nota de Segurança
• http://technet.microsoft.com/en-us/security/bulletin/ms13-084 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3895 · Nota de Segurança
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18991 · Nota