Microsoft Corp. on Thursday urged SharePoint 2007 administrators to protect systems against a recently revealed zero-day vulnerability that could be exploited to steal company secrets.
The bug, which was disclosed Wednesday by the Swiss security consultancy High-Tech Bridge, could be used by attackers to pilfer confidential information from companies' SharePoint servers, which are widely used to power corporate intranets and enable internal collaboration. "The most likely attack scenario is that an attacker sends a malicious link to a user who is logged into their SharePoint server. If the user clicks the link, the JavaScript created by the attacker and embedded in the link would execute in the context of the user who clicked the link," said a trio of Microsoft security engineers in an entry on the company's "Security Research & Defense" blog late Thursday.
I'm getting a pop-up connection from this site when I click on your link, Barney. Is it your link or is it me?? It goes to your link first and then to the rogue site.