PT-2017-18456 · Microsoft · Sharepoint Server 2010 Service Pack 2+1

Publicado 2017-08-08 · Atualizado 2017-08-15 · CVE-2017-8654

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Microsoft SharePoint Server 2010 Service Pack 2

Description A cross-site scripting (XSS) issue exists due to improper sanitization of specially crafted web requests to affected SharePoint servers. An authenticated attacker could exploit this by sending a specially crafted request, allowing cross-site scripting attacks on affected systems and running script in the security context of the current user. This could enable the attacker to read unauthorized content, use the victim's identity to take actions on the SharePoint site, such as changing permissions and deleting content, and inject malicious content into the user's browser.

Recommendations For Microsoft SharePoint Server 2010 Service Pack 2, update to a version that includes the fix for this issue to prevent cross-site scripting attacks. As a temporary workaround, consider restricting access to sensitive areas of the SharePoint server and implementing additional security measures to minimize the risk of exploitation.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2017-8654

Produtos afetados

Sharepoint Server 2010 Service Pack 2

Sharepoint Server

Referências · 6

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8654 · Nota de Segurança
• http://securitytracker.com/id/1039111 · Nota
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8654 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-8654 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-8654 · Nota de Segurança
• http://securityfocus.com/bid/100064 · Nota