exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

ms03-002

ms03-002
Posted Jan 27, 2002

Microsoft Security Advisory MS03-002 - The Microsoft Content Management Server 2001 contains a cross site scripting flaw in an ASP page.

tags | xss, asp
SHA-256 | 74a7aed76f12d26a055fd96848693567f0b873d08688f03ea7cc1d73ea07e8ab

ms03-002

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----

- ----------------------------------------------------------------------
Title: Cumulative Patch for Microsoft Content Management Server
(810487)
Date: 22 January 2003
Software: Microsoft Content Management Server 2001
Impact: Information Disclosure
Max Risk: Moderate
Bulletin: MS03-002

Microsoft encourages customers to review the Security Bulletins at:
http://www.microsoft.com/technet/security/bulletin/MS03-002.asp
http://www.microsoft.com/security/security_bulletins/ms03-002.asp
- ----------------------------------------------------------------------

Issue:
======
Microsoft Content Management Server (MCMS) 2001 is an Enterprise
Server product that simplifies developing and managing E-Commerce
web sites. MCMS includes a number of pre-defined ASP web pages that
allow web site operators to quickly set up E-business websites.

A Cross-Site Scripting flaw exists in one of these ASP pages that
could allow an attacker to insert script into the data being sent
to a MCMS server. Because the server generates a web page in
response to a user request made using this page, it is possible that
the script could be embedded within the page that CMS generates and
returns to the user, this script would then run when processed by
the user's browser. This could result in an attacker being able to
access information the user shared with the legitimate site.

An attacker might attempt to exploit this flaw by crafting a
malicious link to a valid site that the user intended to visit.
If the attacker were able to get a user to click the link-most
likely by sending the link in an email-then it could be possible
for the attacker to take a variety of actions. The attacker could
alter the data that appeared to be contained on the web pages
presented by the legitimate site, monitor the user's session with
the legitimate site and copy personal data from the legitimate site
to a site under the attacker's control, or access the legitimate
site's cookies.

Mitigating Factors:
====================
- This flaw is not present in Microsoft Content Management
Server 2002.
- The attacker would have no way to force users to visit
the malicious site. Instead, the attacker would need to
lure them there, typically by getting them to click on
a link that would take them to the attacker's site.

Risk Rating:
============
- Moderate

Patch Availability:
===================
- A patch is available to fix this vulnerability. Please read the
Security Bulletins at
http://www.microsoft.com/technet/security/bulletin/ms03-002.asp
http://www.microsoft.com/security/security_bulletins/ms03-002.asp

for information on obtaining this patch.


- ---------------------------------------------------------------------

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT DISCLAIMS
ALL
WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE
WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
IN NO EVENT
SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR ANY
DAMAGES
WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL,
LOSS OF
BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF MICROSOFT CORPORATION OR
ITS
SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. SOME
STATES DO
NOT ALLOW THE EXCLUSION OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL
OR
INCIDENTAL DAMAGES SO THE FOREGOING LIMITATION MAY NOT APPLY.

-----BEGIN PGP SIGNATURE-----
Version: PGP 7.1

iQEVAwUBPi7heI0ZSRQxA/UrAQEmzAgAgID/nmgK4Azm+gzggSq5H3O3eg0jJ9IX
BTK1PUMnJtbQGTftRXgNKeKox/vJfnmVPiz2mm0XVXpA8FhYD8PFZzgzf1CRjy6u
xw+Z/BNKF2thkwP3vCCdArHk+cDQukaMQPjSB7Pq7GdAo2gjlnomnIEXpjxogGYr
LMyjKL2Z5YkgJjdYMF2BIsrSdnMtyH551K9/+gUSy5C9KDCKFbmfAFWFdIwouzad
iF6g+STuFagTXycvFKitY1lauTqGtiVEzTACbwfQmfGNZgMWHMHMMnaBj/VAXWI/
DJFcDVGMYjk3y6hxSkvUvVQb4/oJEVuwuDuCsNhnAtjIOXh/5AneLQ==
=qa7Y
-----END PGP SIGNATURE-----

Login or Register to add favorites

File Archive:

December 2023

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Dec 1st
    11 Files
  • 2
    Dec 2nd
    0 Files
  • 3
    Dec 3rd
    0 Files
  • 4
    Dec 4th
    32 Files
  • 5
    Dec 5th
    10 Files
  • 6
    Dec 6th
    13 Files
  • 7
    Dec 7th
    23 Files
  • 8
    Dec 8th
    19 Files
  • 9
    Dec 9th
    1 Files
  • 10
    Dec 10th
    0 Files
  • 11
    Dec 11th
    0 Files
  • 12
    Dec 12th
    0 Files
  • 13
    Dec 13th
    0 Files
  • 14
    Dec 14th
    0 Files
  • 15
    Dec 15th
    0 Files
  • 16
    Dec 16th
    0 Files
  • 17
    Dec 17th
    0 Files
  • 18
    Dec 18th
    0 Files
  • 19
    Dec 19th
    0 Files
  • 20
    Dec 20th
    0 Files
  • 21
    Dec 21st
    0 Files
  • 22
    Dec 22nd
    0 Files
  • 23
    Dec 23rd
    0 Files
  • 24
    Dec 24th
    0 Files
  • 25
    Dec 25th
    0 Files
  • 26
    Dec 26th
    0 Files
  • 27
    Dec 27th
    0 Files
  • 28
    Dec 28th
    0 Files
  • 29
    Dec 29th
    0 Files
  • 30
    Dec 30th
    0 Files
  • 31
    Dec 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close