Vulnerability CVE-2010-3243 - CERT Civis.Net

Vulnerability Name:

CVE-2010-3243 (CCN-62083)

Assigned:

2010-10-12

Published:

2010-10-12

Updated:

2021-07-23

Summary:

Cross-site scripting (XSS) vulnerability in the toStaticHTML function in Microsoft Internet Explorer 8, and the SafeHTML function in Microsoft Windows SharePoint Services 3.0 SP2 and Office SharePoint Server 2007 SP2, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "HTML Sanitization Vulnerability."

CVSS v3 Severity:

5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): Low Integrity (I): None Availibility (A): None

CVSS v2 Severity:

4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
3.2 Low (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Authentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): Partial Availibility (A): None

4.3 Medium (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N)
3.2 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Athentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): None Availibility (A): None

Vulnerability Type:

Vulnerability Consequences:

Obtain Information

References:

Source: MITRE
Type: CNA
CVE-2010-3243

Source: CCN
Type: SA41746
Microsoft SharePoint Two Script Insertion Vulnerabilities

Source: CONFIRM
Type: UNKNOWN
http://support.avaya.com/css/P8/documents/100113324

Source: CCN
Type: Microsoft Security Bulletin MS11-099
Cumulative Security Update for Internet Explorer (2618444)

Source: CCN
Type: Microsoft Security Bulletin MS12-010
Cumulative Security Update for Internet Explorer (2647516)

Source: CCN
Type: Microsoft Security Bulletin MS12-023
Cumulative Security Update for Internet Explorer (2675157)

Source: CCN
Type: Microsoft Security Bulletin MS12-037
Cumulative Security Update for Internet Explorer (2699988)

Source: CCN
Type: Microsoft Security Bulletin MS12-044
Cumulative Security Update for Internet Explorer (2719177)

Source: CCN
Type: Microsoft Security Bulletin MS12-052
Cumulative Security Update for Internet Explorer (2722913)

Source: CCN
Type: Microsoft Security Bulletin MS10-071
Cumulative Security Update for Internet Explorer (2360131)

Source: CCN
Type: Microsoft Security Bulletin MS10-072
Vulnerabilities in SafeHTML Could Allow Information Disclosure (2412048)

Source: CCN
Type: Microsoft Security Bulletin MS10-090
Cumulative Security Update for Internet Explorer (2416400)

Source: CCN
Type: Microsoft Security Bulletin MS11-003
Cumulative Security Update for Internet Explorer (2482017)

Source: CCN
Type: Microsoft Security Bulletin MS11-018
Cumulative Security Update for Internet Explorer (2497640)

Source: CCN
Type: Microsoft Security Bulletin MS11-050
Cumulative Security Update for Internet Explorer (2530548)

Source: CCN
Type: Microsoft Security Bulletin MS11-057
Cumulative Security Update for Internet Explorer (2559049)

Source: CCN
Type: Microsoft Security Bulletin MS11-081
Cumulative Security Update for Internet Explorer (2586448)

Source: CCN
Type: BID-43703
Microsoft Internet Explorer 'toStaticHTML' HTML Sanitizing Information Disclosure Vulnerability

Source: CERT
Type: US Government Resource
TA10-285A

Source: MS
Type: UNKNOWN
MS10-071

Source: MS
Type: UNKNOWN
MS10-072

Source: XF
Type: UNKNOWN
ms-ie-tostatichtml-info-disc(62083)

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:7637

Vulnerable Configuration:

Configuration 1:

cpe:/a:microsoft:sharepoint_services:3.0:sp2:x32:*:*:*:*:*

OR cpe:/a:microsoft:sharepoint_services:3.0:sp2:x64:*:*:*:*:*

OR cpe:/a:microsoft:sharepoint_server:2007:sp2:x32:*:*:*:*:*

OR cpe:/a:microsoft:sharepoint_server:2007:sp2:x64:*:*:*:*:*

Configuration 2:

cpe:/a:microsoft:internet_explorer:8:*:*:*:*:*:*:*

AND

cpe:/o:microsoft:windows_xp:*:sp3:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_vista:*:sp2:x64:*:*:*:*:*

OR cpe:/o:microsoft:windows_server_2008:*:*:*:*:*:*:x32:*

OR cpe:/o:microsoft:windows_server_2008:r2:*:*:*:*:*:itanium:*

OR cpe:/o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_vista:*:sp1:x64:*:*:*:*:*

OR cpe:/o:microsoft:windows_server_2008:r2:*:*:*:*:*:x64:*

OR cpe:/o:microsoft:windows_xp:-:sp2:x64:*:*:*:*:*

OR cpe:/o:microsoft:windows_server_2003:*:sp2:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_server_2008:*:sp2:*:*:*:*:x32:*

OR cpe:/o:microsoft:windows_server_2008:*:*:x64:*:*:*:*:*

OR cpe:/o:microsoft:windows_7:-:*:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_server_2008:*:sp2:*:*:*:*:x64:*

OR cpe:/o:microsoft:windows_vista:*:sp1:*:*:*:*:*:*

Configuration CCN 1:

cpe:/a:microsoft:ie:8.0:*:*:*:*:*:*:*

OR cpe:/a:microsoft:sharepoint_server:2007:sp2:x32:*:*:*:*:*

OR cpe:/a:microsoft:sharepoint_server:2007:sp2:x64:*:*:*:*:*

OR cpe:/a:microsoft:sharepoint_services:3.0:sp2:x32:*:*:*:*:*

OR cpe:/a:microsoft:sharepoint_services:3.0:sp2:x64:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:org.mitre.oval:def:7637	V	HTML Sanitization Vulnerability (CVE-2010-3243)	2014-08-18