CVE

Id
43300  
CVE No.
CVE-2010-0716  
Status
Candidate  
Description
_layouts/Upload.aspx in the Documents module in Microsoft SharePoint before 2010 uses URLs with the same hostname and port number for a web site"s primary files and individual users" uploaded files (aka attachments), which allows remote authenticated users to leverage same-origin relationships and conduct cross-site scripting (XSS) attacks by uploading TXT files, a related issue to CVE-2008-5026. NOTE: the vendor disputes the significance of this issue, because cross-domain isolation can be implemented when needed.  
Phase
Assigned (20100226)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
471667 43300 CVE-2010-0716 BUGTRAQ:20100222 Hacktics Advisory Feb10: Persistent XSS in Microsoft SharePoint Portal  View
471668 43300 CVE-2010-0716 URL:http://www.securityfocus.com/archive/1/archive/1/509683/100/0/threaded  View
471669 43300 CVE-2010-0716 MISC:http://www.hacktics.com/content/advisories/AdvMS20100222.html  View
471670 43300 CVE-2010-0716 XF:sharepoint-aspx-xss(56597)  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
39500 JVNDB-2010-005285 Erotik Auktionshaus の news.php における SQL インジェクションの脆弱性 Erotik Auktionshaus の news.php には、SQL インジェクションの脆弱性が存在します。 CVE-2010-0720 43300 7.5 http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-005285.html  View