HTTP: Microsoft SharePoint scriptresx.ashx Cross-Site Scripting
This signature detects attempts against a known flaw in Microsoft SharePoint Server. The scriptresx.ashx file is vulnerable to a Cross Site Scripting (XSS) attack which could allow an authenticated attacker to execute commands as an authorized administrator.
Extended Description
Microsoft SharePoint is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to perform unauthorized actions such as reading, modifying, or deleting content on behalf of the victim on the SharePoint site.
Affected Products
Microsoft sharepoint_server_2010
Short Name
HTTP:IIS:SP-SCRIPTRESX-XSS
Severity
Major
Recommended
False
Recommended Action
Drop
Category
HTTP
Keywords
CVE-2012-1859 Cross-Site Microsoft Scripting SharePoint bid:54312 scriptresx.ashx
Release Date
07/09/2012
Supported Platforms
srx-branch-12.3
srx-19.3
srx-branch-19.3
vsrx3bsd-19.2
srx-branch-19.4
vsrx-19.4
mx-12.3
mx-19.4
vmx-19.4
mx-19.3
vsrx3bsd-19.4
srx-19.4
vsrx-12.3
vmx-19.3
vsrx-19.2
srx-12.3
Sigpack Version
3336
False Positive
Unknown
Vendors
Microsoft
CVSS Score
4.3