CVE-2010-3324

2010-09-1718:00:03

CWE-79

[email protected]

web.nvd.nist.gov

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

AI Score

5.1

Confidence

High

EPSS

0.961

Percentile

99.6%

JSON

The toStaticHTML function in Microsoft Internet Explorer 8, and the SafeHTML function in Microsoft Windows SharePoint Services 3.0 SP2, SharePoint Foundation 2010, Office SharePoint Server 2007 SP2, Groove Server 2010, and Office Web Apps, allows remote attackers to bypass the cross-site scripting (XSS) protection mechanism and conduct XSS attacks via a crafted use of the Cascading Style Sheets (CSS) @import rule, aka “HTML Sanitization Vulnerability,” a different vulnerability than CVE-2010-1257.

Affected configurations

Nvd

Node

microsoftgroove_serverMatch2010

microsoftinternet_explorerMatch8

microsoftsharepoint_foundationMatch2010

microsoftsharepoint_serverMatch2007sp2

microsoftsharepoint_servicesMatch3.0sp2x32

microsoftweb_apps

VendorProductVersionCPE
microsoftgroove_server2010cpe:2.3:a:microsoft:groove_server:2010:*:*:*:*:*:*:*
microsoftinternet_explorer8cpe:2.3:a:microsoft:internet_explorer:8:*:*:*:*:*:*:*
microsoftsharepoint_foundation2010cpe:2.3:a:microsoft:sharepoint_foundation:2010:*:*:*:*:*:*:*
microsoftsharepoint_server2007cpe:2.3:a:microsoft:sharepoint_server:2007:sp2:*:*:*:*:*:*
microsoftsharepoint_services3.0cpe:2.3:a:microsoft:sharepoint_services:3.0:sp2:x32:*:*:*:*:*
microsoftweb_apps*cpe:2.3:a:microsoft:web_apps:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
microsoft	groove_server	2010	cpe:2.3:a:microsoft:groove_server:2010:::::::*
microsoft	internet_explorer	8	cpe:2.3:a:microsoft:internet_explorer:8:::::::*
microsoft	sharepoint_foundation	2010	cpe:2.3:a:microsoft:sharepoint_foundation:2010:::::::*
microsoft	sharepoint_server	2007	cpe:2.3:a:microsoft:sharepoint_server:2007:sp2::::::
microsoft	sharepoint_services	3.0	cpe:2.3:a:microsoft:sharepoint_services:3.0:sp2:x32:::::*
microsoft	web_apps	*	cpe:2.3:a:microsoft:web_apps::::::::