CVE-2012-1863 : Cross-site scripting (XSS) vulnerability in Microsoft Office SharePoint Server 2

Cross-site scripting (XSS) vulnerability in Microsoft Office SharePoint Server 2007 SP2 and SP3 Windows SharePoint Services 3.0 SP2, and SharePoint Foundation 2010 Gold and SP1 allows remote attackers to inject arbitrary web script or HTML via crafted JavaScript elements in a URL, aka "SharePoint Reflected List Parameter Vulnerability."

Published 2012-07-10 21:55:06

Updated 2018-10-12 22:02:49

Source Microsoft Corporation

View at NVD, CVE.org

Vulnerability category: Cross site scripting (XSS)

Products affected by CVE-2012-1863

Microsoft » Sharepoint Services » Version: 3.0 Update SP2 X64 Edition
cpe:2.3:a:microsoft:sharepoint_services:3.0:sp2:x64:*:*:*:*:*
Matching versions
Microsoft » Sharepoint Services » Version: 3.0 Update SP2 X32 Edition
cpe:2.3:a:microsoft:sharepoint_services:3.0:sp2:x32:*:*:*:*:*
Matching versions
Microsoft » Sharepoint Server » Version: 2007 Update SP2
cpe:2.3:a:microsoft:sharepoint_server:2007:sp2:*:*:*:*:*:*
Matching versions
Microsoft » Sharepoint Server » Version: 2007 Update SP3
cpe:2.3:a:microsoft:sharepoint_server:2007:sp3:*:*:*:*:*:*
Matching versions
Microsoft » Office Sharepoint Server » Version: 2007 Update SP2 X32 Edition
cpe:2.3:a:microsoft:office_sharepoint_server:2007:sp2:x32:*:*:*:*:*
Matching versions
Microsoft » Office Sharepoint Server » Version: 2007 Update SP2 X64 Edition
cpe:2.3:a:microsoft:office_sharepoint_server:2007:sp2:x64:*:*:*:*:*
Matching versions
Microsoft » Office Sharepoint Server » Version: 2007 Update SP3 X64 Edition
cpe:2.3:a:microsoft:office_sharepoint_server:2007:sp3:x64:*:*:*:*:*
Matching versions
Microsoft » Office Sharepoint Server » Version: 2007 Update SP3 X32 Edition
cpe:2.3:a:microsoft:office_sharepoint_server:2007:sp3:x32:*:*:*:*:*
Matching versions
Microsoft » Sharepoint Foundation » Version: 2010
cpe:2.3:a:microsoft:sharepoint_foundation:2010:*:*:*:*:*:*:*
Matching versions
Microsoft » Sharepoint Foundation » Version: 2010 Update SP1
cpe:2.3:a:microsoft:sharepoint_foundation:2010:sp1:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2012-1863

EPSS FAQ

87.44%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 99 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2012-1863

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
4.3	MEDIUM	AV:N/AC:M/Au:N/C:N/I:P/A:N	8.6	2.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None

CWE ids for CVE-2012-1863

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2012-1863

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-050

Microsoft Security Bulletin MS12-050 - Important | Microsoft Docs

CVEs referencing this url
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15689

Repository / Oval Repository
http://www.us-cert.gov/cas/techalerts/TA12-192A.html

Microsoft Updates for Multiple Vulnerabilities | CISA
US Government Resource

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2012-1863

Products affected by CVE-2012-1863

Exploit prediction scoring system (EPSS) score for CVE-2012-1863

CVSS scores for CVE-2012-1863

CWE ids for CVE-2012-1863

References for CVE-2012-1863