CVE-2010-3324 Cross-site scripting in n/a
Remote attackers can bypass XSS protections in Internet Explorer and SharePoint via crafted CSS imports, enabling cross-site scripting attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2010-3324?
CVE-2010-3324 is a medium-severity cross-site scripting vulnerability in Microsoft Internet Explorer, published on 17 Sep 2010. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The toStaticHTML function in Microsoft Internet Explorer 8, and the SafeHTML function in Microsoft Windows SharePoint Services 3.0 SP2, SharePoint Foundation 2010, Office SharePoint Server 2007 SP2, Groove Server 2010, and Office Web Apps, allows remote attackers to bypass the cross-site scripting (XSS) protection mechanism and conduct XSS attacks via a crafted use of the Cascading Style Sheets (CSS) @import rule, aka "HTML Sanitization Vulnerability," a different vulnerability than CVE-2010-1257.
Weakness: CWE-79
Which versions are affected by CVE-2010-3324?
It affects 6 products.
Products include Microsoft Groove Server, Microsoft Internet Explorer, Microsoft Sharepoint Foundation, Microsoft Sharepoint Server, Microsoft Sharepoint Services, Microsoft Web Apps.
How do I fix CVE-2010-3324?
No fix has been published for CVE-2010-3324 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2010-3324 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2010-3324 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in Microsoft Internet Explorer
Sources
Also known as GHSA-p4fm-mppm-v7m5.