PT-2010-1169 · Microsoft · Forefront Unified Access Gateway

Eyal Gruner · Published 2010-11-09 · Updated 2018-10-12 · CVE-2010-3936

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Forefront Unified Access Gateway versions 2010 Gold, 2010 Update 1, and 2010 Update 2

Description The issue is related to a lack of protection for the web page structure in the Signurl.asp component. This allows a remote attacker to perform cross-site scripting (XSS) attacks, which can enable the injection of arbitrary web scripts or HTML.

Recommendations For Microsoft Forefront Unified Access Gateway versions 2010 Gold, 2010 Update 1, and 2010 Update 2, consider restricting access to the Signurl.asp component until a patch is available. As a temporary workaround, avoid using the Signurl.asp component in sensitive operations to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2021-04412

CVE-2010-3936

Affected Products

Forefront Unified Access Gateway

References · 5

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-089 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-04412 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2010-3936 · Security Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12218 · Note
• http://us-cert.gov/cas/techalerts/TA10-313A.html · Note