{"vuid":"VU#372618","idnumber":"372618","name":"Groove Mobile Workspace vulnerable to script injection via SharePoint lists containing picture columns","keywords":["Groove Mobile Workspace","script injection","SharePoint","picture columns"],"overview":"A vulnerability in the way that Groove Mobile Workspace handles picture columns embedded within SharePoint lists may allow attackers to execute an arbitrary script.","clean_desc":"Groove Virtual Office provides a collaborative working environment that includes shared documents, databases, applications, and various other tools to facilitate communication and productivity. Microsoft Windows SharePoint Services for Windows Server 2003 and SharePoint Team Services are used to create collaborative Web sites. A SharePoint list is a collection of information and objects displayed on a SharePoint site. If a SharePoint list containing picture column is copied into a Groove Mobile Workspace, that list, including the picture column may not be properly filtered for malicious content. As a result, an attacker may be able to inject scripting code into the picture column, which will then be executed within the Groove Virtual Office environment.","impact":"An attacker may be able to execute arbitrary scripts with the privileges of the compromised user.","resolution":"Update\nThis vulnerability is addressed in Groove Virtual Office 3.1 build 2338, 3.1a build 2364, and Groove Workspace Version 2.5n build 1871. These updates are available from http://www.groove.net/update and http://www.groove.net/archive.","workarounds":"","sysaffected":"","thanks":"This vulnerability was reported by US-CERT.","author":"This document was written by Jeff Gennari.","public":["http://www.groove.net","http://www.groove.net/index.cfm?pagename=Support_Overview","http://www.groove.net/update","http://www.groove.net/archive"],"cveids":["CVE-2005-1676"],"certadvisory":"","uscerttechnicalalert":null,"datecreated":"2005-04-07T18:27:16Z","publicdate":"2005-05-19T00:00:00Z","datefirstpublished":"2005-05-19T15:27:38Z","dateupdated":"2005-05-19T15:44:00Z","revision":54,"vrda_d1_directreport":"","vrda_d1_population":"","vrda_d1_impact":"","cam_widelyknown":"5","cam_exploitation":"0","cam_internetinfrastructure":"3","cam_population":"15","cam_impact":"17","cam_easeofexploitation":"9","cam_attackeraccessrequired":"7","cam_scorecurrent":"2.40975","cam_scorecurrentwidelyknown":"6.92803125","cam_scorecurrentwidelyknownexploited":"12.95240625","ipprotocol":"","cvss_accessvector":"","cvss_accesscomplexity":"","cvss_authentication":null,"cvss_confidentialityimpact":"","cvss_integrityimpact":"","cvss_availabilityimpact":"","cvss_exploitablity":null,"cvss_remediationlevel":"","cvss_reportconfidence":"","cvss_collateraldamagepotential":"","cvss_targetdistribution":"","cvss_securityrequirementscr":"","cvss_securityrequirementsir":"","cvss_securityrequirementsar":"","cvss_basescore":"","cvss_basevector":"","cvss_temporalscore":"","cvss_environmentalscore":"","cvss_environmentalvector":"","metric":2.40975,"vulnote":null}