PT-2012-4077 · Microsoft · Groove Server+7

Andrew Lyons + 1 · Published 2012-10-09 · Updated 2018-10-12 · CVE-2012-2520

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Microsoft InfoPath versions 2007 SP2 through 2007 SP3 Microsoft InfoPath version 2010 SP1 Microsoft Communicator version 2007 R2 Microsoft Lync versions 2010 and 2010 Attendee Microsoft SharePoint Server versions 2007 SP2 through 2007 SP3 Microsoft SharePoint Server version 2010 SP1 Microsoft Groove Server version 2010 SP1 Microsoft Windows SharePoint Services version 3.0 SP2 Microsoft SharePoint Foundation version 2010 SP1 Microsoft Office Web Apps version 2010 SP1

Description The issue allows remote attackers to inject arbitrary web script or HTML via a crafted string. This is due to an elevation of privilege vulnerability in the way that HTML strings are sanitized. An attacker who successfully exploited this vulnerability could perform cross-site scripting attacks and run script in the security context of the logged-on user.

Recommendations For Microsoft InfoPath versions 2007 SP2 through 2007 SP3, update to a newer version to mitigate the risk. For Microsoft InfoPath version 2010 SP1, update to a newer version to mitigate the risk. For Microsoft Communicator version 2007 R2, update to a newer version to mitigate the risk. For Microsoft Lync versions 2010 and 2010 Attendee, update to a newer version to mitigate the risk. For Microsoft SharePoint Server versions 2007 SP2 through 2007 SP3, update to a newer version to mitigate the risk. For Microsoft SharePoint Server version 2010 SP1, update to a newer version to mitigate the risk. For Microsoft Groove Server version 2010 SP1, update to a newer version to mitigate the risk. For Microsoft Windows SharePoint Services version 3.0 SP2, update to a newer version to mitigate the risk. For Microsoft SharePoint Foundation version 2010 SP1, update to a newer version to mitigate the risk. For Microsoft Office Web Apps version 2010 SP1, update to a newer version to mitigate the risk.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2012-2520

Affected Products

Ge Communicator

Groove Server

Infopath

Lync

Office Web Apps

Sharepoint Foundation

Sharepoint Server

Windows Sharepoint Services

References · 13

• https://nvd.nist.gov/vuln/detail/CVE-2012-2520 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2520 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-066 · Vendor Advisory
• http://securitytracker.com/id?1027626 · Note
• http://us-cert.gov/cas/techalerts/TA12-283A.html · Note
• http://securityfocus.com/bid/55797 · Note
• http://securitytracker.com/id?1027628 · Note
• http://technet.microsoft.com/en-us/security/bulletin/ms12-066 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2520 · Note
• http://securitytracker.com/id?1027627 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14976 · Note
• http://securitytracker.com/id?1027625 · Note
• http://securitytracker.com/id?1027629 · Note