Vulnerability Details : CVE-2012-1892
Cross-site scripting (XSS) vulnerability in Microsoft Visual Studio Team Foundation Server 2010 SP1 allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka "XSS Vulnerability."
Vulnerability category: Cross site scripting (XSS)
Exploit prediction scoring system (EPSS) score for CVE-2012-1892
Probability of exploitation activity in the next 30 days: 75.97%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 98 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2012-1892
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|
|
4.3
|
MEDIUM | AV:N/AC:M/Au:N/C:N/I:P/A:N |
8.6
|
2.9
|
nvd@nist.gov |
CWE ids for CVE-2012-1892
-
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.Assigned by: nvd@nist.gov (Primary)
References for CVE-2012-1892
-
http://www.securitytracker.com/id?1027511
Microsoft Visual Studio Team Foundation Server Input Validation Flaw Permits Cross-Site Scripting Attacks - SecurityTracker
-
http://www.us-cert.gov/cas/techalerts/TA12-255A.html
Microsoft Updates for Multiple Vulnerabilities | CISAUS Government Resource
-
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-061
Microsoft Security Bulletin MS12-061 - Important | Microsoft Docs
-
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15779
Repository / Oval Repository
-
http://www.securityfocus.com/bid/55409
Microsoft Visual Studio Team Foundation Server CVE-2012-1892 Cross Site Scripting Vulnerability
Products affected by CVE-2012-1892
- cpe:2.3:a:microsoft:visual_studio_team_foundation_server:2010:sp1:*:*:*:*:*:*