PT-2010-4735 · Microsoft · Office Sharepoint Server 2007 Sp2+8

Mario Heiderich · Published 2010-09-17 · Updated 2021-07-23 · CVE-2010-3324

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Internet Explorer 8 Microsoft Windows SharePoint Services 3.0 SP2 SharePoint Foundation 2010 Office SharePoint Server 2007 SP2 Groove Server 2010 Office Web Apps (affected versions not specified)

Description The issue allows remote attackers to bypass the cross-site scripting (XSS) protection mechanism and conduct XSS attacks via a crafted use of the Cascading Style Sheets (CSS) @import rule. An information disclosure vulnerability exists in the way that the SafeHTML function and the toStaticHTML API sanitize HTML, which could allow an attacker to perform cross-site scripting attacks and run script in the security context of the logged-on user. This could enable the attacker to execute a cross-site scripting attack on the user, allowing the execution of script in the user's security context against a site that is using the toStaticHTML API.

Recommendations For Microsoft Internet Explorer 8, consider disabling the toStaticHTML function as a temporary workaround until a patch is available. For Microsoft Windows SharePoint Services 3.0 SP2, SharePoint Foundation 2010, Office SharePoint Server 2007 SP2, Groove Server 2010, and Office Web Apps, restrict access to the SafeHTML function to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2010-3324

Affected Products

Groove Server 2010

Internet Explorer

Internet Explorer 8

Windows Sharepoint Services 3.0 Sp2

Office Sharepoint Server 2007 Sp2

Office Web Apps

Sharepoint Foundation 2010

Sharepoint Foundation

Sharepoint Server

References · 13

• 🔥 https://exploit-db.com/exploits/34478 · Exploit
• 🔥 http://archives.neohapsis.com/archives/fulldisclosure/2010-08/0179.html · Exploit
• 🔥 http://wooyun.org/bug.php?action=view&id=189 · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3324 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2010-3324 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-071 · Vendor Advisory
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-072 · Vendor Advisory
• http://us-cert.gov/cas/techalerts/TA10-285A.html · Note
• http://support.avaya.com/css/P8/documents/100113324 · Note
• https://docs.microsoft.com/security-updates/securitybulletins/2010/MS10-071 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7297 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3324 · Note
• https://docs.microsoft.com/security-updates/securitybulletins/2010/MS10-072 · Note