CVE-2012-2520

EXPLOITED

Microsoft Groove Server 2010 SP1 - Cross-Site Scripting

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2012-2520 has been observed exploited in the wild (reported by VulnCheck KEV).

Description

Cross-site scripting (XSS) vulnerability in Microsoft InfoPath 2007 SP2 and SP3 and 2010 SP1, Communicator 2007 R2, Lync 2010 and 2010 Attendee, SharePoint Server 2007 SP2 and SP3 and 2010 SP1, Groove Server 2010 SP1, Windows SharePoint Services 3.0 SP2, SharePoint Foundation 2010 SP1, and Office Web Apps 2010 SP1 allows remote attackers to inject arbitrary web script or HTML via a crafted string, aka "HTML Sanitization Vulnerability."

References (9)

Core 9
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/55797
Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14976
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id?1027628
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id?1027626
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id?1027629
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id?1027627
Third Party Advisory, US Government Resource third-party-advisory x_refsource_cert
http://www.us-cert.gov/cas/techalerts/TA12-283A.html
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id?1027625

Scores

EPSS 0.2848
EPSS Percentile 97.9%

Details

VulnCheck KEV 2014-01-15
CWE
CWE-79
Status published
Products (10)
microsoft/groove_server 2010 sp1
microsoft/infopath 2007 sp2
microsoft/infopath 2010 sp1
microsoft/lync 2010 (2 CPE variants)
microsoft/office_communicator 2007 r2
microsoft/office_web_apps 2010 sp1
microsoft/sharepoint_foundation 2010 sp1
microsoft/sharepoint_server 2007 sp2 (2 CPE variants)
microsoft/sharepoint_server 2010 sp1
microsoft/sharepoint_services 3.0 sp2
Published Oct 09, 2012
Tracked Since Feb 18, 2026