PT-2013-3048 · Microsoft · Groove Server 2010 Sp1+5

Andrew Lyons + 1 · Published 2013-04-09 · Updated 2018-10-12 · CVE-2013-1289

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Microsoft SharePoint Server 2010 SP1 Groove Server 2010 SP1 SharePoint Foundation 2010 SP1 Office Web Apps 2010 SP1

Description The issue is related to an elevation of privilege vulnerability that allows remote attackers to inject arbitrary web script or HTML via a crafted string. This vulnerability enables cross-site scripting (XSS) attacks, which can be exploited by an attacker to run a script in the security context of the current user.

Recommendations For Microsoft SharePoint Server 2010 SP1, consider disabling HTML sanitization functions until a patch is available. For Groove Server 2010 SP1, restrict access to HTML string sanitization to minimize the risk of exploitation. For SharePoint Foundation 2010 SP1, avoid using crafted strings that could lead to XSS attacks until the issue is resolved. For Office Web Apps 2010 SP1, as a temporary workaround, consider restricting the execution of scripts in the context of the current user.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2013-1289

Affected Products

Groove Server 2010 Sp1

Sharepoint Server 2010 Sp1

Office Web Apps 2010 Sp1

Sharepoint Foundation 2010 Sp1

Sharepoint Foundation

Sharepoint Server

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2013-1289 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1289 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-035 · Vendor Advisory
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16599 · Note
• http://technet.microsoft.com/en-us/security/bulletin/ms13-035 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1289 · Note
• http://us-cert.gov/ncas/alerts/TA13-100A · Note