#VU3048 Cross-site scripting in Microsoft products - CVE-2010-0817

Description

The vulnerability allows a remote attacker to perform XSS attacks.

The vulnerability exists due to insufficient sanitization of user-supplied input data passed to Help.aspx script. A remote attacker can trick the victim into following a specially crafted link and execute arbitrary HTML and script code in victim’s browser in context of vulnerable SharePoint website.

Successful exploitation may allow an attacker to conduct phishing and drive-by-download attacks.

Note: this vulnerability is being publicly exploited.

Remediation

External links

• https://technet.microsoft.com/en-us/library/security/ms10-039.aspx
• https://www.htbridge.com/advisory/HTB22350