Microsoft warns of cross-site scripting error

Microsoft is warning of a flaw in SharePoint

Microsoft is warning of a flaw in SharePoint Server 2007 and SharePoint Services 3.0 which could allow a cross-site scripting attack.

The company said that there have been no reports of attacks targeting the vulnerability, which could allow an attacker to access the SharePoint site with elevated privileges.

Administrators are advised to apply an access control list to the SharePoint Help.aspx file to prevent unauthorised users gaining access to the vulnerable components.

Applying the measure will, however, disable the help function for all users on the affected SharePoint site.

Microsoft noted that the cross-site scripting protections in Internet Explorer 8 could also help to prevent an attack.

The firm is developing and fix and is currently planning to release a patch next month with its May security update.