PT-2009-6055 · Microsoft · Office Sharepoint Server 2007

Published 2009-10-30 · Updated 2018-10-10 · CVE-2009-3830

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Office SharePoint Server 2007 versions 12.0.0.4518 through 12.0.0.6219

Description The issue allows remote attackers to read ASP.NET source code. This is achieved by manipulating pathnames in the SourceUrl and Source parameters to the "/ layouts/download.aspx" API endpoint.

Recommendations For Microsoft Office SharePoint Server 2007 versions 12.0.0.4518 through 12.0.0.6219, consider restricting access to the layouts/download.aspx API endpoint until a fix is available. As a temporary workaround, avoid using the SourceUrl and Source parameters in the affected API endpoint.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2009-3830

Affected Products

Office Sharepoint Server 2007

References · 7

• 🔥 https://exploit-db.com/exploits/9967 · Exploit
• 🔥 http://securityfocus.com/bid/36817 · Exploit
• http://support.microsoft.com/kb/976829 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-3830 · Security Note
• http://securityfocus.com/archive/1/507419/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/53955 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3830 · Note