Medium severity · published Jun 16, 2011
CVE-2011-1252
Cross-site scripting (XSS) vulnerability in the SafeHTML function in the toStaticHTML API in Microsoft Internet Explorer 7 and 8, Office SharePoint Server 2007 SP2, Office…
6.1
CVSS
14%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in the SafeHTML function in the toStaticHTML API in Microsoft Internet Explorer 7 and 8, Office SharePoint Server 2007 SP2, Office SharePoint Server 2010 Gold and SP1, Groove Server 2010 Gold and SP1, Windows SharePoint Services 3.0 SP2, and SharePoint Foundation 2010 Gold and SP1 allows remote attackers to inject arbitrary web script or HTML via unspecified strings, aka "toStaticHTML Information Disclosure Vulnerability" or "HTML Sanitization Vulnerability."
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)14.0% · higher than 97% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IE
Internet Explorer · Microsoft
7; 8 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2011-1252
CVE.org
https://www.cve.org/CVERecord?id=CVE-2011-1252
US Government Resource
http://www.us-cert.gov/cas/techalerts/TA11-256A.html
docs.microsoft.com
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-050
docs.microsoft.com
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-074
oval.cisecurity.org
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12577
oval.cisecurity.org
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12885
More from Internet Explorer
9.8
CVE-2015-0313
Adobe Flash Player Use-After-Free Vulnerability
9.8
CVE-2015-0311
Adobe Flash Player Remote Code Execution Vulnerability
9.8
CVE-2014-1776
Microsoft Internet Explorer Memory Corruption Vulnerability
8.8
CVE-2021-27085
Internet Explorer Remote Code Execution Vulnerability
8.8
CVE-2021-26411
Internet Explorer Memory Corruption Vulnerability