{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2010-04-28T00:00:00", "descriptions": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerability in _layouts/help.aspx in Microsoft SharePoint Server 2007 12.0.0.6421 and possibly earlier, and SharePoint Services 3.0 SP1 and SP2, versions, allows remote attackers to inject arbitrary web script or HTML via the cid0 parameter."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-10-12T19:57:01", "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft"}, "references": [{"name": "MS10-039", "tags": ["vendor-advisory", "x_refsource_MS"], "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-039"}, {"name": "20100428 XSS in Microsoft SharePoint Server 2007", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/511021/100/0/threaded"}, {"name": "TA10-159B", "tags": ["third-party-advisory", "x_refsource_CERT"], "url": "http://www.us-cert.gov/cas/techalerts/TA10-159B.html"}, {"name": "oval:org.mitre.oval:def:7468", "tags": ["vdb-entry", "signature", "x_refsource_OVAL"], "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7468"}, {"tags": ["x_refsource_MISC"], "url": "http://www.htbridge.ch/advisory/xss_in_microsoft_sharepoint_server_2007.html"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "secure@microsoft.com", "ID": "CVE-2010-0817", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Cross-site scripting (XSS) vulnerability in _layouts/help.aspx in Microsoft SharePoint Server 2007 12.0.0.6421 and possibly earlier, and SharePoint Services 3.0 SP1 and SP2, versions, allows remote attackers to inject arbitrary web script or HTML via the cid0 parameter."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "MS10-039", "refsource": "MS", "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-039"}, {"name": "20100428 XSS in Microsoft SharePoint Server 2007", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/511021/100/0/threaded"}, {"name": "TA10-159B", "refsource": "CERT", "url": "http://www.us-cert.gov/cas/techalerts/TA10-159B.html"}, {"name": "oval:org.mitre.oval:def:7468", "refsource": "OVAL", "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7468"}, {"name": "http://www.htbridge.ch/advisory/xss_in_microsoft_sharepoint_server_2007.html", "refsource": "MISC", "url": "http://www.htbridge.ch/advisory/xss_in_microsoft_sharepoint_server_2007.html"}]}}}}, "cveMetadata": {"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "assignerShortName": "microsoft", "cveId": "CVE-2010-0817", "datePublished": "2010-04-29T21:00:00", "dateReserved": "2010-03-02T00:00:00", "dateUpdated": "2018-10-12T19:57:01", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:sharepoint_server:2007:*:*:*:*:*:*:*", "matchCriteriaId": "864B622E-B522-4791-AC82-0711130544BA", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:sharepoint_services:3.0:sp1:x32:*:*:*:*:*", "matchCriteriaId": "FC40A747-CEBB-4F49-A4CF-A2F31890F39E", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:sharepoint_services:3.0:sp1:x64:*:*:*:*:*", "matchCriteriaId": "71AFF167-D300-44A8-8735-E1A0AC8CF9EA", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:sharepoint_services:3.0:sp2:x32:*:*:*:*:*", "matchCriteriaId": "CF40F903-0026-4673-89A3-6F889D877E2F", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:sharepoint_services:3.0:sp2:x64:*:*:*:*:*", "matchCriteriaId": "376C9A84-74B1-4717-B88E-153ADD7D686D", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerability in _layouts/help.aspx in Microsoft SharePoint Server 2007 12.0.0.6421 and possibly earlier, and SharePoint Services 3.0 SP1 and SP2, versions, allows remote attackers to inject arbitrary web script or HTML via the cid0 parameter."}, {"lang": "es", "value": "Una vulnerabilidad de tipo cross-site scripting (XSS) en el archivo _layouts/help.aspx en SharePoint Server 2007 versi\u00f3n 12.0.0.6421 y posiblemente anterior, y SharePoint Services versi\u00f3n 3.0 SP1 y SP2 de Microsoft, permite a los atacantes remotos inyectar script web o HTML arbitrario por medio del par\u00e1metro cid0."}], "id": "CVE-2010-0817", "lastModified": "2018-10-12T21:57:15.323", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}]}, "published": "2010-04-29T21:30:00.370", "references": [{"source": "secure@microsoft.com", "tags": ["Exploit"], "url": "http://www.htbridge.ch/advisory/xss_in_microsoft_sharepoint_server_2007.html"}, {"source": "secure@microsoft.com", "url": "http://www.securityfocus.com/archive/1/511021/100/0/threaded"}, {"source": "secure@microsoft.com", "tags": ["US Government Resource"], "url": "http://www.us-cert.gov/cas/techalerts/TA10-159B.html"}, {"source": "secure@microsoft.com", "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-039"}, {"source": "secure@microsoft.com", "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7468"}], "sourceIdentifier": "secure@microsoft.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}