(MS12-007) Vulnerability in AntiXSS Library Could Allow Information Disclosure (2607664)
Publish date: 11 de enero de 2012
Gravedad: High
Identificadores de CVE : CVE-2012-0007
Fecha recomendada: 11 de enero de 2012
Descripción
This security update resolves one privately reported vulnerability in the Microsoft Anti-Cross Site Scripting (AntiXSS) Library. The vulnerability could allow information disclosure if a an attacker passes a malicious script to a website using the sanitization function of the AntiXSS Library.
The consequences of the disclosure of that information depend on the nature of the information itself. Note that this vulnerability would not allow an attacker to execute code or to elevate the attacker's user rights directly, but it could be used to produce information that could be used to try to further compromise the affected system. Only sites that use the sanitization module of the AntiXSS Library are affected by this vulnerability.
Soluciones
Software y versión afectados
- Microsoft Anti-Cross Site Scripting Library V3.x and Microsoft Anti-Cross Site Scripting Library V4.0