CVE-2010-0817
published 2010-04-29CVE-2010-0817: Cross-site scripting (XSS) vulnerability in _layouts/help.aspx in Microsoft SharePoint Server 2007 12.0.0.6421 and possibly earlier, and SharePoint Services…
PriorityP270medium4.3CVSS 2.0
AVNACMAuNCNIPAN
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
28.71%
97.9th percentile
Cross-site scripting (XSS) vulnerability in _layouts/help.aspx in Microsoft SharePoint Server 2007 12.0.0.6421 and possibly earlier, and SharePoint Services 3.0 SP1 and SP2, versions, allows remote attackers to inject arbitrary web script or HTML via the cid0 parameter.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | sharepoint_server | — | — |
| microsoft | sharepoint_services | — | — |
Detection & IOCsextracted from sources · hover to see the quote
urlhttp://host/_layouts/help.aspx?cid0=MS.WSS.manifest.xml%00%3Cscript%3Ealert%28%27XSS%27%29%3C/script%3E&tid=X↗
snort
alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SERVER Microsoft SharePoint Server 2007 _layouts/help.aspx Cross Site Scripting Attempt"; flow:established,to_server; http.uri; content:"/_layouts/help.aspx"; nocase; content:"cid0="; nocase; pcre:"/cid0\x3d.+(script|alert|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange)/i"; reference:url,www.htbridge.ch/advisory/xss_in_microsoft_sharepoint_server_2007.html; reference:url,tools.cisco.com/security/center/viewAlert.x?alertId=20415; reference:url,www.microsoft.com/technet/security/Bulletin/MS10-039.mspx; reference:url,tools.cisco.com/security/center/viewAlert.x?alertId=20610; reference:cve,2010-0817; classtype:web-application-attack; sid:2011073; rev:8; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, cve CVE_2010_0817, deployment Datacenter, signature_severity Major, tag XSS, tag Cross_Site_Scripting, updated_at 2020_09_14;)
- →The vulnerable parameter is 'cid0' in the query string of /_layouts/help.aspx. Inspect HTTP requests targeting this path for unsanitized script injection payloads in the cid0 parameter, including null-byte (%00) bypass attempts. ↗
- →The PoC payload uses a null-byte (%00) followed by URL-encoded script tags in the cid0 parameter to bypass input filtering — monitor for %00 in cid0 values targeting this endpoint. ↗
- →Successful exploitation can result in theft of cookie-based authentication credentials — monitor for anomalous cookie exfiltration following requests to /_layouts/help.aspx. ↗
- →The Emerging Threats Snort rule (sid:2011073) uses a PCRE to match cid0 parameter values containing XSS event handlers or script keywords: script, alert, onmouse*, onkey*, onload, onunload, ondragdrop, onblur, onfocus, onclick, ondblclick, onsubmit, onreset, onselect, onchange.
- ·The vulnerability was disclosed as unpatched at time of initial advisory; it was later addressed in Microsoft Security Bulletin MS10-039. Ensure the Snort rule reference is updated accordingly. ↗
- ·The affected version is explicitly identified as 12.0.0.6421 and possibly earlier; scope detection rules to SharePoint Server 2007 and SharePoint Services 3.0 SP1/SP2 hosts only. ↗
CVSS provenance
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
vulncheck4.3MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-xj8q-vqrm-hvqr: Cross-site scripting (XSS) vulnerability in _layouts/help
ghsa_unreviewed·2022-05-02
CVE-2010-0817 [MEDIUM] CWE-79 GHSA-xj8q-vqrm-hvqr: Cross-site scripting (XSS) vulnerability in _layouts/help
Cross-site scripting (XSS) vulnerability in _layouts/help.aspx in Microsoft SharePoint Server 2007 12.0.0.6421 and possibly earlier, and SharePoint Services 3.0 SP1 and SP2, versions, allows remote attackers to inject arbitrary web script or HTML via the cid0 parameter.
VulnCheck
Microsoft SharePoint Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
vulncheck·2010·CVSS 4.3
CVE-2010-0817 [MEDIUM] Microsoft SharePoint Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Microsoft SharePoint Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Cross-site scripting (XSS) vulnerability in _layouts/help.aspx in Microsoft SharePoint Server 2007 12.0.0.6421 and possibly earlier, and SharePoint Services 3.0 SP1 and SP2, versions, allows remote attackers to inject arbitrary web script or HTML via the cid0 parameter.
Affected: Microsoft SharePoint
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://learn.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-039
Suricata
ET WEB_SERVER Microsoft SharePoint Server 2007 _layouts/help.aspx Cross Site Scripting Attempt
suricata·2010-07-30
CVE-2010-0817 ET WEB_SERVER Microsoft SharePoint Server 2007 _layouts/help.aspx Cross Site Scripting Attempt
ET WEB_SERVER Microsoft SharePoint Server 2007 _layouts/help.aspx Cross Site Scripting Attempt
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SERVER Microsoft SharePoint Server 2007 _layouts/help.aspx Cross Site Scripting Attempt"; flow:established,to_server; http.uri; content:"/_layouts/help.aspx"; nocase; content:"cid0="; nocase; pcre:"/cid0\x3d.+(script|alert|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange)/i"; reference:url,www.htbridge.ch/advisory/xss_in_microsoft_sharepoint_server_2007.html; reference:url,tools.cisco.com/security/center/viewAlert.x?alertId=20415; reference:url,www.microsoft.com/technet/security/Bulletin/MS10-039.mspx; reference:url,tools.cisco.com/security/center/viewAler
Zscaler
Zscaler Provides Protection for 3 Microsoft Vulnerabilities
blogs_zscaler·CVSS 9.3
[CRITICAL] Zscaler Provides Protection for 3 Microsoft Vulnerabilities
Provide users with seamless, secure, reliable access to applications and data.
Build and run secure cloud apps, enable zero trust cloud connectivity, and protect workloads from data center to cloud.
Provide zero trust connectivity for IoT and OT devices and secure remote access to OT systems.
Provide zero trust site-to-site connectivity and reliable access to B2B apps for partners.
Industry Report
Zscaler: A Leader in the 2025 Gartner® Magic Quadrant™ for Security Service Edge (SSE)
USE CASES
INDUSTRY & MARKET SOLUTIONS
PARTNERS
TECHNOLOGY PARTNERS
Resource Center
Events & Trainings
Security Research & Services
Tools
Community & Support
CXO REVOLUTIONARIES
Amplifying the voices of real-world digital and zero trust pioneers
Discover how it began and where it’s going
Meet o
Zscaler
Zscaler found Multiple Security Vulnerabilities | 06-08-2010
blogs_zscaler·CVSS 9.3
[CRITICAL] Zscaler found Multiple Security Vulnerabilities | 06-08-2010
Provide users with seamless, secure, reliable access to applications and data.
Build and run secure cloud apps, enable zero trust cloud connectivity, and protect workloads from data center to cloud.
Provide zero trust connectivity for IoT and OT devices and secure remote access to OT systems.
Provide zero trust site-to-site connectivity and reliable access to B2B apps for partners.
Industry Report
Zscaler: A Leader in the 2025 Gartner® Magic Quadrant™ for Security Service Edge (SSE)
USE CASES
INDUSTRY & MARKET SOLUTIONS
PARTNERS
TECHNOLOGY PARTNERS
Resource Center
Events & Trainings
Security Research & Services
Tools
Community & Support
CXO REVOLUTIONARIES
Amplifying the voices of real-world digital and zero trust pioneers
Discover how it began and where it’s going
Meet o
http://www.htbridge.ch/advisory/xss_in_microsoft_sharepoint_server_2007.htmlhttp://www.securityfocus.com/archive/1/511021/100/0/threadedhttp://www.us-cert.gov/cas/techalerts/TA10-159B.htmlhttps://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-039https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7468http://www.htbridge.ch/advisory/xss_in_microsoft_sharepoint_server_2007.htmlhttp://www.securityfocus.com/archive/1/511021/100/0/threadedhttp://www.us-cert.gov/cas/techalerts/TA10-159B.htmlhttps://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-039https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7468
2010-04-29
Published
Exploited in the wild