$ cve CVE-2010-3324 JSON

CVE-2010-3324 EXPLOIT

4.3

MEDIUM · CVSS 2.0 · EPSS 25% (pctl 98)

Patch early

A public exploit exists.

Description

The toStaticHTML function in Microsoft Internet Explorer 8, and the SafeHTML function in Microsoft Windows SharePoint Services 3.0 SP2, SharePoint Foundation 2010, Office SharePoint Server 2007 SP2, Groove Server 2010, and Office Web Apps, allows remote attackers to bypass the cross-site scripting (XSS) protection mechanism and conduct XSS attacks via a crafted use of the Cascading Style Sheets (CSS) @import rule, aka "HTML Sanitization Vulnerability," a different vulnerability than CVE-2010-1257.

Scoring

CVSS	4.3 (MEDIUM, v2.0)
Vector	AV:N/AC:M/Au:N/C:N/I:P/A:N
EPSS	25.02% — more likely to be exploited than 98% of all CVEs
Weakness	CWE-79
On CISA KEV	no
Public exploit	yes
Published	2010-09-17
Last modified	2026-06-16

Affected (6)

Vendor	Product
microsoft	groove server
microsoft	internet explorer
microsoft	sharepoint foundation
microsoft	sharepoint server
microsoft	sharepoint services
microsoft	web apps

Public exploits

Source	Title	Date
exploit-db	Microsoft Internet Explorer 8 - 'toStaticHTML()' HTML Sanitization Bypass	2010-08-16

References

→ the Explorer · watch your stack · NVD