CVE-2007-2581

Multiple cross-site scripting (XSS) vulnerabilities in Microsoft Windows SharePoint Services 3.0 for Windows Server 2003 and Office SharePoint Server 2007 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO (query string) in "every main page," as demonstrated by default.aspx.

Affected products

Windows Sharepoint Services 3.0, Office Sharepoint Server 2007, Sharepoint Server

Microsoft Sharepoint Server

= 2007

Microsoft Sharepoint Services

= 3.0

Microsoft Windows 2003

All versions

CVSS 2.0

4.3 MEDIUM

EPSS

36.2% (98th percentile)

Weakness

CWE-79

NVD status

Modified

Published

2007-05-09