CVE-2012-1863: XSS
First published: Tue Jul 10 2012(Updated: )
Cross-site scripting (XSS) vulnerability in Microsoft Office SharePoint Server 2007 SP2 and SP3 Windows SharePoint Services 3.0 SP2, and SharePoint Foundation 2010 Gold and SP1 allows remote attackers to inject arbitrary web script or HTML via crafted JavaScript elements in a URL, aka "SharePoint Reflected List Parameter Vulnerability."
Credit: secure@microsoft.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Microsoft SharePoint Portal Server | =2007-sp2 | |
| Microsoft SharePoint Portal Server | =2007-sp2 | |
| Microsoft SharePoint Portal Server | =2007-sp3 | |
| Microsoft SharePoint Portal Server | =2007-sp3 | |
| Microsoft SharePoint Foundation 2013 | =2010 | |
| Microsoft SharePoint Foundation 2013 | =2010-sp1 | |
| Microsoft SharePoint Server 2010 | =2007-sp2 | |
| Microsoft SharePoint Server 2010 | =2007-sp3 | |
| Microsoft SharePoint Services | =3.0-sp2 | |
| Microsoft SharePoint Services | =3.0-sp2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2012-1863?
CVE-2012-1863 is classified as a medium severity vulnerability due to its potential for cross-site scripting attacks.
How do I fix CVE-2012-1863?
To mitigate CVE-2012-1863, ensure that you apply the latest security updates from Microsoft for affected SharePoint versions.
What types of applications are affected by CVE-2012-1863?
CVE-2012-1863 affects Microsoft Office SharePoint Server 2007 SP2/SP3, Windows SharePoint Services 3.0 SP2, and SharePoint Foundation 2010.
Can CVE-2012-1863 lead to data disclosure?
Yes, CVE-2012-1863 can lead to data disclosure as attackers may inject malicious scripts that capture user data.
Is there a workaround for CVE-2012-1863?
A viable workaround for CVE-2012-1863 is to restrict input validation and escape any untrusted data before rendering it.
- agent/severity
- agent/weakness
- agent/references
- agent/author
- agent/type
- agent/description
- agent/first-publish-date
- agent/last-modified-date
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/event
- vendor/microsoft
- canonical/microsoft sharepoint portal server
- version/microsoft sharepoint portal server/2007-sp2
- version/microsoft sharepoint portal server/2007-sp3
- canonical/microsoft sharepoint foundation 2013
- version/microsoft sharepoint foundation 2013/2010
- version/microsoft sharepoint foundation 2013/2010-sp1
- canonical/microsoft sharepoint server 2010
- version/microsoft sharepoint server 2010/2007-sp2
- version/microsoft sharepoint server 2010/2007-sp3
- canonical/microsoft sharepoint services
- version/microsoft sharepoint services/3.0-sp2