What is the CVSS score of CVE-2012-1860?

CVE-2012-1860 has a CVSS 2.0 base score of 5.5 (Medium). CVSS vector: AV:N/AC:L/Au:S/C:P/I:N/A:P. EPSS exploitation probability: 0.9%.

Office Web Apps CVE-2012-1860

MEDIUM

Permissions, Privileges, and Access Controls (CWE-264)

2012-07-10 secure@microsoft.com

Privilege Escalation Denial Of Service Microsoft Office Web Apps Sharepoint Server

5.5

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

AV:N/AC:L/Au:S/C:P/I:N/A:P

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:N/AC:L/Au:S/C:P/I:N/A:P

Attack Vector

Network

Attack Complexity

Low

Confidentiality

Integrity

None

Availability

Lifecycle Timeline

CVE Published

Jul 10, 2012 - 21:55 cve.org

MEDIUM 5.5

DescriptionCVE.org

Microsoft Office SharePoint Server 2007 SP2 and SP3, SharePoint Server 2010 Gold and SP1, and Office Web Apps 2010 Gold and SP1 do not properly check permissions for search scopes, which allows remote authenticated users to obtain sensitive information or cause a denial of service (data modification) by changing a parameter in a search-scope URL, aka "SharePoint Search Scope Vulnerability."

AnalysisAI

Microsoft Office SharePoint Server 2007 SP2 and SP3, SharePoint Server 2010 Gold and SP1, and Office Web Apps 2010 Gold and SP1 do not properly check permissions for search scopes, which allows. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-264. Microsoft Office SharePoint Server 2007 SP2 and SP3, SharePoint Server 2010 Gold and SP1, and Office Web Apps 2010 Gold and SP1 do not properly check permissions for search scopes, which allows remote authenticated users to obtain sensitive information or cause a denial of service (data modification) by changing a parameter in a search-scope URL, aka "SharePoint Search Scope Vulnerability." Affected products include: Microsoft Office Web Apps, Microsoft Sharepoint Server.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.