製品・ソフトウェアに関する情報

JVN脆弱性詳細

Microsoft Internet Explorer 7 および 8 におけるクロスサイトスクリプティングの脆弱性

Title	Microsoft Internet Explorer 7 および 8 におけるクロスサイトスクリプティングの脆弱性
Summary	Microsoft Internet Explorer 7 および 8 の toStaticHTML API には、クロスサイトスクリプティングの脆弱性が存在します。
Possible impacts	第三者により、未確定の文字列を介して、任意の Web スクリプトまたは HTML を挿入される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	June 14, 2011, midnight
Registration Date	June 27, 2011, 4:22 p.m.
Last Update	June 27, 2011, 4:22 p.m.

CVSS2.0 : 警告
Score	4.3
Vector	AV:N/AC:M/Au:N/C:N/I:P/A:N

Affected System

マイクロソフト

Microsoft Internet Explorer 7

Microsoft Internet Explorer 8

Microsoft Windows 7 (x32)

Microsoft Windows 7 (x64)

Microsoft Windows Server 2003

Microsoft Windows Server 2003 (itanium)

Microsoft Windows Server 2003 (x64)

Microsoft Windows Server 2008 (itanium)

Microsoft Windows Server 2008 (x64)

Microsoft Windows Server 2008 (x86)

Microsoft Windows Server 2008 r2(itanium)

Microsoft Windows Server 2008 r2(x64)

Microsoft Windows Vista

Microsoft Windows Vista (x64)

Microsoft Windows XP (x64)

Microsoft Windows XP sp3

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2011-1252	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1252
National Vulnerability Database (NVD)
2	CVE-2011-1252	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-1252

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-79	https://jvndb.jvn.jp/ja/cwe/CWE-79.html

ベンダー情報

No	Name	URL
Microsoft Security Bulletin
1	MS11-050	http://www.microsoft.com/technet/security/bulletin/MS11-050.mspx
マイクロソフトセキュリティ情報
2	MS11-050	http://www.microsoft.com/japan/technet/security/bulletin/MS11-050.mspx
富士通セキュリティ情報
3	TA11-165A	http://software.fujitsu.com/jp/security/vulnerabilities/ta11-165a.html
絵でみるセキュリティ情報
4	MS11-050e	http://www.microsoft.com/japan/security/bulletins/MS11-050e.mspx

その他

No	Name	URL
IPA 緊急対策情報
1	20110621-ms11-050	http://www.ipa.go.jp/security/ciadr/vul/20110621-ms11-050.html
JPCERT 緊急報告
2	JPCERT-AT-2011-0016	https://www.jpcert.or.jp/at/2011/at110016.txt
JVN
3	JVNTA11-165A	http://jvn.jp/cert/JVNTA11-165A
Secunia Advisory
4	SA44914	http://secunia.com/advisories/44914
SecurityFocus
5	48199	http://www.securityfocus.com/bid/48199
SecurityTracker
6	1025649	http://www.securitytracker.com/id/1025649
US-CERT Cyber Security Alerts
7	SA11-165A	http://www.us-cert.gov/cas/alerts/SA11-165A.html
US-CERT Technical Cyber Security Alert
8	TA11-165A	http://www.us-cert.gov/cas/techalerts/TA11-165A.html
警察庁 @police
9	マイクロソフト社のセキュリティ修正プログラムについて(MS11-037,038,039,040,041,042,043,044,045,046,047,048,049,050,051,052)(2011年06月15日)	http://www.npa.go.jp/cyberpolice/#topics

Change Log

No	Changed Details	Date of change
0	[2011年06月27日] 掲載	Feb. 17, 2018, 10:37 a.m.

NVD Vulnerability Information

CVE-2011-1252

Summary	Cross-site scripting (XSS) vulnerability in the SafeHTML function in the toStaticHTML API in Microsoft Internet Explorer 7 and 8, Office SharePoint Server 2007 SP2, Office SharePoint Server 2010 Gold and SP1, Groove Server 2010 Gold and SP1, Windows SharePoint Services 3.0 SP2, and SharePoint Foundation 2010 Gold and SP1 allows remote attackers to inject arbitrary web script or HTML via unspecified strings, aka "toStaticHTML Information Disclosure Vulnerability" or "HTML Sanitization Vulnerability."
Publication Date	June 17, 2011, 5:55 a.m.
Registration Date	Jan. 28, 2021, 4:38 p.m.
Last Update	Nov. 21, 2024, 10:25 a.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:microsoft:internet_explorer:7:::::::*
execution environment
1	cpe:2.3:o:microsoft:windows_2003_server::sp2::::::*
2	cpe:2.3:o:microsoft:windows_2003_server::sp2:itanium:::::
3	cpe:2.3:o:microsoft:windows_server_2003::sp2::::::*
4	cpe:2.3:o:microsoft:windows_server_2008:::itanium:::::*
5	cpe:2.3:o:microsoft:windows_server_2008:::x32:::::*
6	cpe:2.3:o:microsoft:windows_server_2008:::x64:::::*
7	cpe:2.3:o:microsoft:windows_server_2008::sp2:x32:::::
8	cpe:2.3:o:microsoft:windows_server_2008::sp2:x64:::::
9	cpe:2.3:o:microsoft:windows_server_2008:-:sp2:itanium:::::*
10	cpe:2.3:o:microsoft:windows_vista::sp1::::::*
11	cpe:2.3:o:microsoft:windows_vista::sp2::::::*
12	cpe:2.3:o:microsoft:windows_vista:-:sp2::::::
13	cpe:2.3:o:microsoft:windows_vista:-:sp1::::::
14	cpe:2.3:o:microsoft:windows_xp::sp3::::::*
15	cpe:2.3:o:microsoft:windows_xp:-:sp2:x64:::::*

Configuration2		or higher	or less	more than	less than
cpe:2.3:a:microsoft:internet_explorer:8:::::::*
execution environment
1	cpe:2.3:o:microsoft:windows_2003_server::sp2:itanium:::::
2	cpe:2.3:o:microsoft:windows_7::::::::
3	cpe:2.3:o:microsoft:windows_7:-:::::::*
4	cpe:2.3:o:microsoft:windows_server_2003::sp2::::::*
5	cpe:2.3:o:microsoft:windows_server_2008::sp2:x64:::::
6	cpe:2.3:o:microsoft:windows_server_2008::r2:itanium:::::
7	cpe:2.3:o:microsoft:windows_server_2008:::itanium:::::*
8	cpe:2.3:o:microsoft:windows_server_2008:::x32:::::*
9	cpe:2.3:o:microsoft:windows_server_2008:::x64:::::*
10	cpe:2.3:o:microsoft:windows_server_2008::sp2:x32:::::
11	cpe:2.3:o:microsoft:windows_server_2008::r2:x64:::::
12	cpe:2.3:o:microsoft:windows_server_2008:-:sp2:itanium:::::*
13	cpe:2.3:o:microsoft:windows_vista::sp1::::::*
14	cpe:2.3:o:microsoft:windows_vista::sp2::::::*
15	cpe:2.3:o:microsoft:windows_vista:-:sp1::::::
16	cpe:2.3:o:microsoft:windows_xp::sp3::::::*
17	cpe:2.3:o:microsoft:windows_xp:-:sp2:x64:::::*

Related information, measures and tools

No	URL	タグ
1	http://www.us-cert.gov/cas/techalerts/TA11-256A.html	US Government Resource
2	https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-050
3	https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-074
4	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12577
5	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12885
6	http://www.us-cert.gov/cas/techalerts/TA11-256A.html	US Government Resource
7	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12885
8	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12577
9	https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-074
10	https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-050

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-79	クロスサイト・スクリプティング（XSS）	https://cwe.mitre.org/data/definitions/79.html

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:microsoft:internet_explorer:7:::::::*
execution environment
1	cpe:2.3:o:microsoft:windows_2003_server::sp2::::::*
2	cpe:2.3:o:microsoft:windows_2003_server::sp2:itanium:::::
3	cpe:2.3:o:microsoft:windows_server_2003::sp2::::::*
4	cpe:2.3:o:microsoft:windows_server_2008:::itanium:::::*
5	cpe:2.3:o:microsoft:windows_server_2008:::x32:::::*
6	cpe:2.3:o:microsoft:windows_server_2008:::x64:::::*
7	cpe:2.3:o:microsoft:windows_server_2008::sp2:x32:::::
8	cpe:2.3:o:microsoft:windows_server_2008::sp2:x64:::::
9	cpe:2.3:o:microsoft:windows_server_2008:-:sp2:itanium:::::*
10	cpe:2.3:o:microsoft:windows_vista::sp1::::::*
11	cpe:2.3:o:microsoft:windows_vista::sp2::::::*
12	cpe:2.3:o:microsoft:windows_vista:-:sp2::::::
13	cpe:2.3:o:microsoft:windows_vista:-:sp1::::::
14	cpe:2.3:o:microsoft:windows_xp::sp3::::::*
15	cpe:2.3:o:microsoft:windows_xp:-:sp2:x64:::::*

Configuration2		or higher	or less	more than	less than
cpe:2.3:a:microsoft:internet_explorer:8:::::::*
execution environment
1	cpe:2.3:o:microsoft:windows_2003_server::sp2:itanium:::::
2	cpe:2.3:o:microsoft:windows_7::::::::
3	cpe:2.3:o:microsoft:windows_7:-:::::::*
4	cpe:2.3:o:microsoft:windows_server_2003::sp2::::::*
5	cpe:2.3:o:microsoft:windows_server_2008::sp2:x64:::::
6	cpe:2.3:o:microsoft:windows_server_2008::r2:itanium:::::
7	cpe:2.3:o:microsoft:windows_server_2008:::itanium:::::*
8	cpe:2.3:o:microsoft:windows_server_2008:::x32:::::*
9	cpe:2.3:o:microsoft:windows_server_2008:::x64:::::*
10	cpe:2.3:o:microsoft:windows_server_2008::sp2:x32:::::
11	cpe:2.3:o:microsoft:windows_server_2008::r2:x64:::::
12	cpe:2.3:o:microsoft:windows_server_2008:-:sp2:itanium:::::*
13	cpe:2.3:o:microsoft:windows_vista::sp1::::::*
14	cpe:2.3:o:microsoft:windows_vista::sp2::::::*
15	cpe:2.3:o:microsoft:windows_vista:-:sp1::::::
16	cpe:2.3:o:microsoft:windows_xp::sp3::::::*
17	cpe:2.3:o:microsoft:windows_xp:-:sp2:x64:::::*