PT-2014-5699 · Microsoft · Sharepoint Foundation 2010 Sp2+1

Publicado 2014-11-11 · Atualizado 2018-10-12 · CVE-2014-4116

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Microsoft SharePoint Foundation 2010 SP2

Description The issue is related to a cross-site scripting (XSS) vulnerability that allows remote authenticated users to inject arbitrary web script or HTML via a modified list. This is also referred to as an elevation of privilege vulnerability, where SharePoint Server does not properly sanitize page content in SharePoint lists. An authenticated attacker who successfully exploits this vulnerability could run arbitrary code in the security context of the logged-on user.

Recommendations For Microsoft SharePoint Foundation 2010 SP2, ensure proper sanitization of page content in SharePoint lists to prevent arbitrary code execution. As a temporary workaround, consider restricting access to modified lists until a proper fix is applied.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2014-4116

Produtos afetados

Sharepoint Foundation 2010 Sp2

Sharepoint Foundation

Referências · 5

• http://securitytracker.com/id/1031192 · Nota
• http://technet.microsoft.com/security/bulletin/ms14-073 · Nota
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-073 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4116 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2014-4116 · Nota de Segurança