CVE-2012-1858

Microsoft Lync 2010 and 2010 Attendee - Cross-Site Scripting via SafeHTML Component

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2012-1858. PoCs published by Adi Cohen.

AI-analyzed exploit summary This exploit demonstrates a bypass of the toStaticHTML sanitization function in Internet Explorer > 8, SharePoint, and Lync by crafting a malicious CSS string that confuses the filtering mechanism, allowing XSS via expression() in CSS.

Description

The toStaticHTML API (aka the SafeHTML component) in Microsoft Internet Explorer 8 and 9, Communicator 2007 R2, and Lync 2010 and 2010 Attendee does not properly handle event attributes and script, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted HTML document, aka "HTML Sanitization Vulnerability."

Exploits (1)

exploitdb WORKING POC VERIFIED

by Adi Cohen · textdoswindows

https://www.exploit-db.com/exploits/19777

View Code ZIP pw:eip

This exploit demonstrates a bypass of the toStaticHTML sanitization function in Internet Explorer > 8, SharePoint, and Lync by crafting a malicious CSS string that confuses the filtering mechanism, allowing XSS via expression() in CSS.

Classification

Working Poc 100%

Attack Type

Xss

Complexity

Moderate

Reliability

Reliable

Target: Internet Explorer > 8, SharePoint, Lync

No auth needed

Prerequisites: User interaction to execute the JavaScript code

MITRE ATT&CK

T1059.007 - JavaScript

mistral-large-3 · analyzed Feb 16, 2026 Full analysis →

References (6)

Core 6

Core References

US Government Resource third-party-advisory x_refsource_cert

http://www.us-cert.gov/cas/techalerts/TA12-192A.html

Vendor Advisory vendor-advisory x_refsource_ms

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-050

US Government Resource third-party-advisory x_refsource_cert

http://www.us-cert.gov/cas/techalerts/TA12-164A.html

Vendor Advisory vendor-advisory x_refsource_ms

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-037

Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15530

Vendor Advisory vendor-advisory x_refsource_ms

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-039

Scores

EPSS 0.2202

EPSS Percentile 97.4%

Details

CWE

CWE-200

Status published

Products (4)

microsoft/internet_explorer 8

microsoft/internet_explorer 9

microsoft/lync 2010 (3 CPE variants)

microsoft/office_communicator 2007 r2

Published Jun 12, 2012

Tracked Since Feb 18, 2026