PT-2012-2243 · Microsoft · Sharepoint Foundation 2010+1

Published 2012-02-14 · Updated 2018-10-12 · CVE-2012-0017

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Microsoft SharePoint Foundation 2010 Gold and SP1

Description A cross-site scripting issue exists, allowing remote attackers to inject arbitrary web script or HTML via JavaScript sequences in a URL. This could result in information disclosure or elevation of privilege if a user clicks a specially crafted URL containing malicious JavaScript elements. When the malicious JavaScript is echoed back to the user's browser, the resulting page could allow an attacker to issue SharePoint commands in the context of the authenticated user on the targeted SharePoint site.

Recommendations For Microsoft SharePoint Foundation 2010 Gold and SP1, consider disabling access to the inplview.aspx page until a patch is available. Restrict access to URLs that may contain malicious JavaScript elements to minimize the risk of exploitation. Avoid using URLs with JavaScript sequences in Microsoft SharePoint 2010 until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2012-0017

Affected Products

Sharepoint Foundation 2010

Sharepoint Foundation

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2012-0017 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0017 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-011 · Vendor Advisory
• http://technet.microsoft.com/en-us/security/bulletin/ms12-011 · Note
• http://us-cert.gov/cas/techalerts/TA12-045A.html · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14637 · Note