CVE-2010-3964
Unrestricted file upload vulnerability in the Document Conversions Launcher Service in Microsoft Office SharePoint Server 2007 SP2, when the Document Conversions Load Balancer Service is enabled, allows remote attackers to execute arbitrary code via a…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 94.2%, higher than 100% of all known CVEs. Patch or mitigate before the next change window.
Description
Unrestricted file upload vulnerability in the Document Conversions Launcher Service in Microsoft Office SharePoint Server 2007 SP2, when the Document Conversions Load Balancer Service is enabled, allows remote attackers to execute arbitrary code via a crafted SOAP request to TCP port 8082, aka "Malformed Request Code Execution Vulnerability."
- CVSS 2.0
- 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
- EPSS
- 94.20% probability · 100th percentile
- CISA KEV
- Not listed
- Affected
- microsoft/sharepoint server
- Source
- secure@microsoft.com
References
- http://osvdb.org/69817
- http://secunia.com/advisories/42631Vendor Advisory
- http://www.securityfocus.com/bid/45264
- http://www.securitytracker.com/id?1024886
- http://www.us-cert.gov/cas/techalerts/TA10-348A.htmlUS Government Resource
- http://www.vupen.com/english/advisories/2010/3226Vendor Advisory
- http://www.zerodayinitiative.com/advisories/ZDI-10-287/
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-104
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11737
- http://osvdb.org/69817
- http://secunia.com/advisories/42631Vendor Advisory
- http://www.securityfocus.com/bid/45264
- http://www.securitytracker.com/id?1024886
- http://www.us-cert.gov/cas/techalerts/TA10-348A.htmlUS Government Resource
- http://www.vupen.com/english/advisories/2010/3226Vendor Advisory
- http://www.zerodayinitiative.com/advisories/ZDI-10-287/
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-104
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11737
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.