CVE-2010-0817: XSS
First published: Thu Apr 29 2010(Updated: )
Cross-site scripting (XSS) vulnerability in _layouts/help.aspx in Microsoft SharePoint Server 2007 12.0.0.6421 and possibly earlier, and SharePoint Services 3.0 SP1 and SP2, versions, allows remote attackers to inject arbitrary web script or HTML via the cid0 parameter.
Credit: secure@microsoft.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Microsoft SharePoint Server 2010 | =2007 | |
| Microsoft SharePoint Services | =3.0-sp1 | |
| Microsoft SharePoint Services | =3.0-sp1 | |
| Microsoft SharePoint Services | =3.0-sp2 | |
| Microsoft SharePoint Services | =3.0-sp2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.htbridge.ch/advisory/xss_in_microsoft_sharepoint_server_2007.html
- http://www.us-cert.gov/cas/techalerts/TA10-159B.html
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7468
- http://www.securityfocus.com/archive/1/511021/100/0/threaded
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-039
Frequently Asked Questions
What is the severity of CVE-2010-0817?
CVE-2010-0817 is classified as a medium severity vulnerability due to its potential for cross-site scripting attacks.
How do I fix CVE-2010-0817?
To mitigate CVE-2010-0817, you should apply the latest security updates and patches from Microsoft for SharePoint Server 2007 and SharePoint Services 3.0.
Who is affected by CVE-2010-0817?
CVE-2010-0817 affects users of Microsoft SharePoint Server 2007 and SharePoint Services versions 3.0 SP1 and SP2.
What does CVE-2010-0817 exploit?
CVE-2010-0817 exploits a cross-site scripting vulnerability that allows remote attackers to inject arbitrary web scripts via the cid0 parameter.
Is CVE-2010-0817 still a concern for current SharePoint installations?
Yes, CVE-2010-0817 remains a concern for installations still running the affected versions of SharePoint without the recommended updates.
- agent/softwarecombine
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/references
- agent/last-modified-date
- agent/author
- agent/event
- agent/description
- agent/first-publish-date
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-historical
- agent/weakness
- vendor/microsoft
- canonical/microsoft sharepoint server 2010
- version/microsoft sharepoint server 2010/2007
- canonical/microsoft sharepoint services
- version/microsoft sharepoint services/3.0-sp1
- version/microsoft sharepoint services/3.0-sp2