CVE-2009-3830

The download functionality in Team Services in Microsoft Office SharePoint Server 2007 12.0.0.4518 and 12.0.0.6219 allows remote attackers to read ASP.NET source code via pathnames in the SourceUrl and Source parameters to _layouts/download.aspx.

CVSS v2.0 5.0 MEDIUM

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://support.microsoft.com/kb/976829	Vendor Advisory
http://www.securityfocus.com/archive/1/507419/100/0/threaded
http://www.securityfocus.com/bid/36817	Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/53955
http://support.microsoft.com/kb/976829	Vendor Advisory
http://www.securityfocus.com/archive/1/507419/100/0/threaded
http://www.securityfocus.com/bid/36817	Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/53955

Configurations

Configuration 1 (hide)

cpe:2.3:a:microsoft:sharepoint_server:2007:*:*:*:*:*:*:*

History

21 Nov 2024, 01:08

Type	Values Removed	Values Added
References	~~() http://support.microsoft.com/kb/976829 - Vendor Advisory~~	() http://support.microsoft.com/kb/976829 - Vendor Advisory
References	~~() http://www.securityfocus.com/archive/1/507419/100/0/threaded -~~	() http://www.securityfocus.com/archive/1/507419/100/0/threaded -
References	~~() http://www.securityfocus.com/bid/36817 - Exploit~~	() http://www.securityfocus.com/bid/36817 - Exploit
References	~~() https://exchange.xforce.ibmcloud.com/vulnerabilities/53955 -~~	() https://exchange.xforce.ibmcloud.com/vulnerabilities/53955 -

Information

Published : 2009-10-30 20:30

Updated : 2024-11-21 01:08

NVD link : CVE-2009-3830

Mitre link : CVE-2009-3830

CVE.ORG link : CVE-2009-3830

JSON object : View

Products Affected

microsoft

sharepoint_server

CWE

CWE-20

Improper Input Validation

{"id": "CVE-2009-3830", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2009-10-30T20:30:00.420", "references": [{"url": "http://support.microsoft.com/kb/976829", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/archive/1/507419/100/0/threaded", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/36817", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/53955", "source": "cve@mitre.org"}, {"url": "http://support.microsoft.com/kb/976829", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/archive/1/507419/100/0/threaded", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/bid/36817", "tags": ["Exploit"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/53955", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "The download functionality in Team Services in Microsoft Office SharePoint Server 2007 12.0.0.4518 and 12.0.0.6219 allows remote attackers to read ASP.NET source code via pathnames in the SourceUrl and Source parameters to _layouts/download.aspx."}, {"lang": "es", "value": "La funcionalidad \"descarga\" en Team Services en Microsoft Office SharePoint Server 2007 v12.0.0.4518 y v12.0.0.6219 permite a atacantes remotos leer fuentes de ASP.NET a trav\u00e9s de nombres de rutas en los par\u00e1metros SourceUrl y Source a _layouts/download.aspx."}], "lastModified": "2024-11-21T01:08:16.693", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:sharepoint_server:2007:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "864B622E-B522-4791-AC82-0711130544BA"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}