thedark
Second Lieutenant
Joined: 30 Jul 2005
Posts: 1074
|
 Posted: Sat Jul 30, 2005 3:20 pm Post subject: WebDAV Service Provider Can Allow Scripts to Levy Requests a |
 |
|
The Microsoft Data Access Component Internet Publishing Provider provides access to WebDAV resources over the Internet. By design, it should differentiate between requests made by a user and those made by a script running in the user’s browser. However, because of an implementation flaw, it handles all requests in the security context of the user. As a result, if a user browsed to a web page or opened an HTML e-mail that contained script, that script could access web-based resources as the user.
Patch: http://www.microsoft.com/Downloads/Release.asp?ReleaseID=29129 |
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
