CVE-2007-2581

Microsoft Windows SharePoint Services 3.0 - XSS

Title source: llm

Description

Multiple cross-site scripting (XSS) vulnerabilities in Microsoft Windows SharePoint Services 3.0 for Windows Server 2003 and Office SharePoint Server 2007 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO (query string) in "every main page," as demonstrated by default.aspx.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Solarius · textremotewindows

https://www.exploit-db.com/exploits/29951

View Code ZIP pw:eip

References (14)

[Third Party Advisory] http://archives.neohapsis.com/archives/bugtraq/2007-05/0196.html

[Vendor Advisory] http://secunia.com/advisories/27148

[US Government Resource] http://www.us-cert.gov/cas/techalerts/TA07-282A.html

[Vendor Advisory] http://www.vupen.com/english/advisories/2007/3439

[Vendor Advisory] https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-059

[Third Party Advisory, VDB Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/34343

[Third Party Advisory, VDB Entry] https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2286

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/archive/1/467738/100/0/threaded

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/archive/1/467749/100/0/threaded

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/archive/1/482366/100/0/threaded

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/23832

[Third Party Advisory, VDB Entry] http://osvdb.org/37630

[Third Party Advisory, VDB Entry] http://securitytracker.com/id?1018789

[Third Party Advisory] http://securityreason.com/securityalert/2682

Scores

EPSS 0.7374

EPSS Percentile 98.8%

Classification

CWE

CWE-79

Status draft

Affected Products (3)

microsoft/sharepoint_server

microsoft/sharepoint_services

microsoft/windows_2003

Timeline

Published May 09, 2007

Tracked Since Feb 18, 2026