_layouts/Upload.aspx in the Documents module in Microsoft SharePoint before 2010 uses URLs with the same hostname and port number for a web site's primary files and individual users' uploaded files (aka attachments), which allows remote authenticated users to leverage same-origin relationships and conduct cross-site scripting (XSS) attacks by uploading TXT files, a related issue to CVE-2008-5026. NOTE: the vendor disputes the significance of this issue, because cross-domain isolation can be implemented when needed.
Metrics
Affected Vendors & Products
References
History
No history.
MITRE
Status: PUBLISHED
Assigner: mitre
Published: 2010-02-26T19:00:00
Updated: 2024-08-07T00:59:39.022Z
Reserved: 2010-02-26T00:00:00
Link: CVE-2010-0716
Vulnrichment
No data.
NVD
Status : Modified
Published: 2010-02-26T19:30:00.807
Modified: 2024-11-21T01:12:48.813
Link: CVE-2010-0716
Redhat
No data.