Microsoft FrontPage Server Extensions HTML cross-site scripting
| fpse-html-xss (25537) |  Medium Risk |
Description:
Microsoft FrontPage Server Extensions (FPSE) is vulnerable to cross-site scripting, caused by improper validation of user-supplied input in the form of HTML. A remote attacker could exploit this vulnerability to execute script in a victim's Web browser within the security context of the hosting Web site.
Consequences:
Gain Access
Remedy:
Apply the appropriate patch for your system, as listed in Microsoft Security Bulletin MS06-017. See References.
References:
- BugTraq Mailing List, Wed Apr 12 2006 - 16:32:16 CDT: Vulnerability in Microsoft FrontPage Server Extensions Could Allow Cross-Site Scripting.
- Microsoft Security Bulletin MS06-017: Vulnerability Using Microsoft Front Page Server Extensions Could Allow Cross Site Scripting (917627).
- BID-17452: Microsoft FrontPage Server Extensions Cross-Site Scripting Vulnerability
- CVE-2006-0015: Cross-site scripting (XSS) vulnerability in _vti_bin/_vti_adm/fpadmdll.dll in Microsoft FrontPage Server Extensions 2002 and SharePoint Team Services allows remote attackers to inject arbitrary web script or HTML, then leverage the attack to execute arbitrary programs or create new accounts, via the (1) operation, (2) command, and (3) name parameters.
- SA19623: Microsoft FrontPage Server Extensions Cross-Site Scripting
- SECTRACK ID: 1015895: Microsoft SharePoint Team Services Input Validation Holes Permit Cross-Site Scripting Attacks
- SECTRACK ID: 1015896: Microsoft FrontPage Server Extensions Input Validation Holes Permit Cross-Site Scripting Attacks
- VUPEN/ADV-2006-1322: Microsoft FrontPage Server Extensions Cross Site Scripting Issue (MS06-017)
Platforms Affected:
- Microsoft FrontPage Server Extensions 2002
- Microsoft SharePoint Team Services
- Microsoft Windows 2000 SP4
- Microsoft Windows 2003 Server SP1
- Microsoft Windows 2003 Server Itanium
- Microsoft Windows 2003 Server SP1 Itanium
- Microsoft Windows 2003 Server x64
- Microsoft Windows XP SP2
- Microsoft Windows XP SP1
- Microsoft Windows XP x64 Professional
Reported:
Apr 11, 2006
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net