PT-2015-5406 · Microsoft · Sharepoint Foundation 2013+5
Published
2015-03-10
·
Updated
2018-10-12
·
CVE-2015-1633
CVSS v2.0
3.5
Low
| Vector | AV:N/AC:M/Au:S/C:N/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
Microsoft SharePoint Foundation 2010 SP2
Microsoft SharePoint Server 2010 SP2
Microsoft SharePoint Foundation 2013 Gold and SP1
Microsoft SharePoint Server 2013 Gold and SP1
Description
The issue allows remote authenticated users to inject arbitrary web script or HTML via a crafted request. An authenticated attacker could exploit these vulnerabilities by sending a specially crafted request to an affected SharePoint server, potentially leading to cross-site scripting attacks. This could enable the attacker to read unauthorized content, use the victim's identity to take actions on the SharePoint site, and inject malicious content in the victim's browser.
Recommendations
For Microsoft SharePoint Foundation 2010 SP2, update to a version that includes the fix for this issue.
For Microsoft SharePoint Server 2010 SP2, update to a version that includes the fix for this issue.
For Microsoft SharePoint Foundation 2013 Gold and SP1, update to a version that includes the fix for this issue.
For Microsoft SharePoint Server 2013 Gold and SP1, update to a version that includes the fix for this issue.
As a temporary workaround, consider restricting access to affected SharePoint servers to minimize the risk of exploitation.
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Sharepoint Foundation 2010
Sharepoint Foundation 2013
Sharepoint Server 2010
Sharepoint Server 2013
Sharepoint Foundation
Sharepoint Server