Cross-site scripting (XSS) vulnerability in the toStaticHTML function in Microsoft Internet Explorer 8, and the SafeHTML function in Micros…

published 2010-10-13 16 y ago modified 2026-06-16 4 mo ago also EUVD-2010-3242

cvss: 4.3; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 15.7%; EPSS 15.7% chance of exploitation in 30 days, percentile 96%
public exploits: 0; none known

Cross-site scripting (XSS) vulnerability in the toStaticHTML function in Microsoft Internet Explorer 8, and the SafeHTML function in Microsoft Windows SharePoint Services 3.0 SP2 and Office SharePoint Server 2007 SP2, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "HTML Sanitization Vulnerability."

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 2 y ago (2024-10-17)

Exploit prediction

15.72% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CNA	3.1	4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
NVD	2.0	4.3	AV:N/AC:M/Au:N/C:N/I:P/A:N

Classification

Weakness

CWE-79 Improper Neutralization of Input During Web Page Generation

References

docs.microsoft.com /en-us/security-updates/securitybulletins/2010/ms10-071
vendor-advisory
docs.microsoft.com /en-us/security-updates/securitybulletins/2010/ms10-072
vendor-advisory
oval.cisecurity.org /repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7637
vdb-entry, signature
us-cert.gov /cas/techalerts/TA10-285A.html
third-party-advisory, us-government-resource
support.avaya.com /css/P8/documents/100113324

Sources

CVE List CVE-2010-3243
NVD CVE-2010-3243

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary