PT-2010-1166 · Microsoft · Sharepoint Services 3.0+1

Published 2010-04-29 · Updated 2018-10-12 · CVE-2010-0817

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Microsoft SharePoint Server 2007 versions 12.0.0.6421 and earlier Microsoft SharePoint Services 3.0 SP1 and SP2

Description The issue is related to a cross-site scripting (XSS) vulnerability that allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the cid0 parameter in the layouts/help.aspx page. The vulnerability is associated with the failure to protect the web page structure, which can lead to remote attackers performing cross-site scripting attacks.

Recommendations For Microsoft SharePoint Server 2007 versions 12.0.0.6421 and earlier, consider restricting access to the layouts/help.aspx page until a fix is available. For Microsoft SharePoint Services 3.0 SP1 and SP2, avoid using the cid0 parameter in the affected page to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2021-04409

CVE-2010-0817

Affected Products

Sharepoint Server 2007

Sharepoint Services 3.0

References · 9

• 🔥 http://htbridge.ch/advisory/xss_in_microsoft_sharepoint_server_2007.html · Exploit
• 🔥 https://exploit-db.com/exploits/12450 · Exploit
• https://bdu.fstec.ru/vul/2021-04409 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2010-0817 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-039 · Vendor Advisory
• http://securityfocus.com/archive/1/511021/100/0/threaded · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0817 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7468 · Note
• http://us-cert.gov/cas/techalerts/TA10-159B.html · Note