Unscored severity · published Sep 15, 2011
CVE-2011-1891
Cross-site scripting (XSS) vulnerability in Microsoft Windows SharePoint Services 3.0 SP2, and SharePoint Foundation 2010 Gold and SP1, allows remote attackers to inject arbitrary…
–
CVSS
16.8%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in Microsoft Windows SharePoint Services 3.0 SP2, and SharePoint Foundation 2010 Gold and SP1, allows remote attackers to inject arbitrary web script or HTML via unspecified parameters in a request to a script, aka "Contact Details Reflected XSS Vulnerability."
Exploitation
Is it being used?
Exploit prediction (EPSS)16.8% · higher than 97% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SF
Sharepoint Foundation · Microsoft
2010; 2010 · source: NVD
SS
Sharepoint Services · Microsoft
3.0; 3.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2011-1891
CVE.org
https://www.cve.org/CVERecord?id=CVE-2011-1891
US Government Resource
http://www.us-cert.gov/cas/techalerts/TA11-256A.html
docs.microsoft.com
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-074
oval.cisecurity.org
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12864
More from Sharepoint Foundation
9.8
CVE-2019-0604
Microsoft SharePoint Remote Code Execution Vulnerability
9.9
CVE-2020-1595
<p>A remote code execution vulnerability exists in Microsoft SharePoint where APIs aren't properly protected from unsafe data input
9.9
CVE-2020-1210
<p>A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package
9.8
CVE-2023-21716
Microsoft Word Remote Code Execution Vulnerability
9.8
CVE-2020-1025
An elevation of privilege vulnerability exists when Microsoft SharePoint Server and Skype for Business Server improperly handle OAuth token validation