CVE-2010-0817 : Cross-site scripting (XSS) vulnerability in

Cross-site scripting (XSS) vulnerability in _layouts/help.aspx in Microsoft SharePoint Server 2007 12.0.0.6421 and possibly earlier, and SharePoint Services 3.0 SP1 and SP2, versions, allows remote attackers to inject arbitrary web script or HTML via the cid0 parameter.

Published 2010-04-29 21:30:00

Updated 2025-04-11 00:51:22

Source Microsoft Corporation

View at NVD, CVE.org

Vulnerability category: Cross site scripting (XSS)

Products affected by CVE-2010-0817

Microsoft » Sharepoint Services » Version: 3.0 Update SP1 X32 Edition
cpe:2.3:a:microsoft:sharepoint_services:3.0:sp1:x32:*:*:*:*:*
Matching versions
Microsoft » Sharepoint Services » Version: 3.0 Update SP2 X64 Edition
cpe:2.3:a:microsoft:sharepoint_services:3.0:sp2:x64:*:*:*:*:*
Matching versions
Microsoft » Sharepoint Services » Version: 3.0 Update SP2 X32 Edition
cpe:2.3:a:microsoft:sharepoint_services:3.0:sp2:x32:*:*:*:*:*
Matching versions
Microsoft » Sharepoint Services » Version: 3.0 Update SP1 X64 Edition
cpe:2.3:a:microsoft:sharepoint_services:3.0:sp1:x64:*:*:*:*:*
Matching versions
Microsoft » Sharepoint Server » Version: 2007
cpe:2.3:a:microsoft:sharepoint_server:2007:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2010-0817

EPSS FAQ

49.25%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 98 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2010-0817

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
4.3	MEDIUM	AV:N/AC:M/Au:N/C:N/I:P/A:N	8.6	2.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None

CWE ids for CVE-2010-0817

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2010-0817

http://www.securityfocus.com/archive/1/511021/100/0/threaded

SecurityFocus
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-039

Microsoft Security Bulletin MS10-039 - Important | Microsoft Docs

CVEs referencing this url
http://www.htbridge.ch/advisory/xss_in_microsoft_sharepoint_server_2007.html

Cross-site Scripting Vulnerability in Microsoft SharePoint Server 2007 - HTB22350 Security Advisory | ImmuniWeb
Exploit
http://www.us-cert.gov/cas/techalerts/TA10-159B.html

Microsoft Updates for Multiple Vulnerabilities | CISA
US Government Resource

CVEs referencing this url
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7468

Repository / Oval Repository

Jump to

Vulnerability Details : CVE-2010-0817

Products affected by CVE-2010-0817

Exploit prediction scoring system (EPSS) score for CVE-2010-0817

CVSS scores for CVE-2010-0817

CWE ids for CVE-2010-0817

References for CVE-2010-0817