PT-2017-18456 · Microsoft · Sharepoint Server 2010 Service Pack 2+1

Published 2017-08-08 · Updated 2017-08-15 · CVE-2017-8654

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Microsoft SharePoint Server 2010 Service Pack 2

Description A cross-site scripting (XSS) issue exists due to improper sanitization of specially crafted web requests to affected SharePoint servers. An authenticated attacker could exploit this by sending a specially crafted request, allowing cross-site scripting attacks on affected systems and running script in the security context of the current user. This could enable the attacker to read unauthorized content, use the victim's identity to take actions on the SharePoint site, such as changing permissions and deleting content, and inject malicious content into the user's browser.

Recommendations For Microsoft SharePoint Server 2010 Service Pack 2, update to a version that includes the fix for this issue to prevent cross-site scripting attacks. As a temporary workaround, consider restricting access to sensitive areas of the SharePoint server and implementing additional security measures to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2017-8654

Affected Products

Sharepoint Server 2010 Service Pack 2

Sharepoint Server

References · 6

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8654 · Security Note
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8654 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-8654 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-8654 · Security Note
• http://securitytracker.com/id/1039111 · Note
• http://securityfocus.com/bid/100064 · Note