MS12-050  Vulnerabilities in SharePoint Could Allow Elevation of Privilege

2012-07-10 This security update resolves one publicly disclosed and five privately reported vulnerabilities in Microsoft SharePoint and Windows SharePoint Services. The most severe vulnerabilities could allow elevation of privilege if a user clicks a specially crafted URL that takes the user to a targeted SharePoint site.
Vulnerabilities addressed in this bulletin:

HTML Sanitization Vulnerability

An information disclosure vulnerability exists in the way that HTML strings are sanitized. An attacker who successfully exploited this vulnerability could perform cross-site scripting attacks and run script in the security context of the logged-on user.
CVE-2012-1858

XSS scriptresx.ashx Vulnerability

A cross-site scripting and elevation of privilege vulnerability exists in SharePoint allows attacker-controlled JavaScript to run in the context of the user clicking a link. This is an elevation of privilege vulnerability as it allows an anonymous attacker to potentially issue SharePoint commands in the context of an authenticated user on the site.
CVE-2012-1859

SharePoint Search Scope Vulnerability

An information disclosure vulnerability exists in the way that SharePoint stores search scopes. An attacker could view or tamper with other users' search scopes.
CVE-2012-1860

SharePoint Script in Username Vulnerability

A cross-site scripting vulnerability exists in SharePoint allows attacker-controlled JavaScript to run in the context of the user clicking a link. This is an elevation of privilege vulnerability as it allows an anonymous attacker to potentially issue SharePoint commands in the context of an authenticated user.
CVE-2012-1861

SharePoint URL Redirection Vulnerability

A URL redirection vulnerability, which could lead to spoofing and information disclosure, exists in SharePoint which could allow an attacker to redirect a user to an external URL.
CVE-2012-1862

SharePoint Reflected List Parameter Vulnerability

A cross-site scripting vulnerability exists in SharePoint allows attacker-controlled JavaScript to run in the context of the user clicking a link. This is an elevation of privilege vulnerability as it allows an anonymous attacker to potentially issue SharePoint commands in the context of an authenticated user.
CVE-2012-1863

Bulletin details at Microsoft.com