Back
CVE-2010-3324
The toStaticHTML function in Microsoft Internet Explorer 8, and the SafeHTML function in Microsoft Windows SharePoint Services 3.0 SP2,…
Medium4.3EPSS 25.0%
- Published
- Updated
- Reserved
- Assigned by
- microsoft
Description
The toStaticHTML function in Microsoft Internet Explorer 8, and the SafeHTML function in Microsoft Windows SharePoint Services 3.0 SP2, SharePoint Foundation 2010, Office SharePoint Server 2007 SP2, Groove Server 2010, and Office Web Apps, allows remote attackers to bypass the cross-site scripting (XSS) protection mechanism and conduct XSS attacks via a crafted use of the Cascading Style Sheets (CSS) @import rule, aka "HTML Sanitization Vulnerability," a different vulnerability than CVE-2010-1257.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Modified | 2.0 | Medium4.3 | AV:N/AC:M/Au:N/C:N/I:P/A:N |
- EPSS (exploitation in 30 days)
- 25.0% · top 2.1% of all CVEs (4 Nov 2026)
Loading the EPSS history…
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.3.
Weakness
Affected products
n/a
- affected n/a
References (7)
- http://www.wooyun.org/bug.php?action=view&id=189 (opens in a new tab)x_refsource_MISCx_transferred
- MS10-071 (opens in a new tab)vendor-advisoryx_refsource_MSx_transferred
- 20100814 IE8 toStaticHtml Bypass (opens in a new tab)mailing-listx_refsource_FULLDISCx_transferred
- oval:org.mitre.oval:def:7297 (opens in a new tab)vdb-entrysignaturex_refsource_OVALx_transferred
- MS10-072 (opens in a new tab)vendor-advisoryx_refsource_MSx_transferred
- TA10-285A (opens in a new tab)third-party-advisoryx_refsource_CERTx_transferred
- http://support.avaya.com/css/P8/documents/100113324 (opens in a new tab)x_refsource_CONFIRMx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2010-3324)Record last updated .