CVE-2007-2581

MEDIUM 4.3CVE-2007-2581 · Published 09/05/2007 · updated 16/06/2026

Package	Affected versions	Patched versions
sharepoint server microsoft	`= 2007`	No fix yet
sharepoint services microsoft	`= 3.0`	No fix yet

Description

Multiple cross-site scripting (XSS) vulnerabilities in Microsoft Windows SharePoint Services 3.0 for Windows Server 2003 and Office SharePoint Server 2007 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO (query string) in "every main page," as demonstrated by default.aspx.

References

archives.neohapsis.com/archives/bugtraq/2007-05/0196.html
osvdb.org/37630
secunia.com/advisories/27148 · Vendor Advisory
securityreason.com/securityalert/2682
securitytracker.com/id
securityfocus.com/archive/1/467738/100/0/threaded
securityfocus.com/archive/1/467749/100/0/threaded
securityfocus.com/archive/1/482366/100/0/threaded
securityfocus.com/bid/23832
us-cert.gov/cas/techalerts/TA07-282A.html · US Government Resource
vupen.com/english/advisories/2007/3439 · Vendor Advisory
docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-059
exchange.xforce.ibmcloud.com/vulnerabilities/34343
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2286

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free