PT-2014-5699 · Microsoft · Sharepoint Foundation 2010 Sp2+1

Published 2014-11-11 · Updated 2018-10-12 · CVE-2014-4116

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Microsoft SharePoint Foundation 2010 SP2

Description The issue is related to a cross-site scripting (XSS) vulnerability that allows remote authenticated users to inject arbitrary web script or HTML via a modified list. This is also referred to as an elevation of privilege vulnerability, where SharePoint Server does not properly sanitize page content in SharePoint lists. An authenticated attacker who successfully exploits this vulnerability could run arbitrary code in the security context of the logged-on user.

Recommendations For Microsoft SharePoint Foundation 2010 SP2, ensure proper sanitization of page content in SharePoint lists to prevent arbitrary code execution. As a temporary workaround, consider restricting access to modified lists until a proper fix is applied.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2014-4116

Affected Products

Sharepoint Foundation 2010 Sp2

Sharepoint Foundation

References · 5

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-073 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4116 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2014-4116 · Security Note
• http://securitytracker.com/id/1031192 · Note
• http://technet.microsoft.com/security/bulletin/ms14-073 · Note