CVE-2010-3324

The toStaticHTML function in Microsoft Internet Explorer 8, and the SafeHTML function in...

4.3 MediumPublic exploit

The toStaticHTML function in Microsoft Internet Explorer 8, and the SafeHTML function in Microsoft Windows SharePoint Services 3.0 SP2, SharePoint Foundation 2010, Office SharePoint Server 2007 SP2, Groove Server 2010, and Office Web Apps, allows remote attackers to bypass the cross-site scripting (XSS) protection mechanism and conduct XSS attacks via a crafted use of the Cascading Style Sheets (CSS) @import rule, aka "HTML Sanitization Vulnerability," a different vulnerability than CVE-2010-1257.

Exploit likelihood

25.0%Up 3.2 points since Feb 4, 2022

What each source reports

NVD Score used 4.3

Record: CVE-2010-3324
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness: CWE-79
Updated: 2026-11-02

CVE List No score

Record: CVE-2010-3324
Updated: 2026-11-02

EUVDEUVD-2010-3322 No score

Record: EUVD-2010-3322
Updated: 2026-11-03

GitHub AdvisoriesGHSA-p4fm-mppm-v7m5 No score

The toStaticHTML function in Microsoft Internet Explorer 8, and the SafeHTML function in...

Record: GHSA-p4fm-mppm-v7m5
Weakness: CWE-79
Updated: 2026-11-02

Affected products

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	Microsoft Internet Explorer 8 - 'toStaticHTML()' HTML Sanitization Bypass	2010-08-16

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2010-3324 is a medium vulnerability (CVSS 4.3) in Microsoft Groove Server, published September 17, 2010. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 25.0%, the 97th percentile. No source names a fixed version.