PT-2014-1682 · Microsoft · Sharepoint Foundation 2013+3

Publicado 2014-08-12 · Atualizado 2018-10-12 · CVE-2014-2816

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft SharePoint Server 2013 Gold and SP1 Microsoft SharePoint Foundation 2013 Gold and SP1

Description An elevation of privilege issue exists, allowing remote authenticated users to gain privileges via a specially crafted app that executes arbitrary code in the security context of the logged-on user. This is achieved by exploiting a vulnerability in the SharePoint extensibility model, enabling the execution of custom actions.

Recommendations For Microsoft SharePoint Server 2013 Gold and SP1, update to a version that includes the fix for this issue. For Microsoft SharePoint Foundation 2013 Gold and SP1, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting the use of custom apps and actions within the SharePoint extensibility model to minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

BDU:2015-00626

BDU:2015-00628

CVE-2014-2816

Produtos afetados

Sharepoint Foundation 2013

Sharepoint Server 2013

Sharepoint Foundation

Sharepoint Server

Referências · 10

• https://bdu.fstec.ru/vul/2015-00628 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2816 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2816 · Nota
• http://securitytracker.com/id/1030720 · Nota
• https://bdu.fstec.ru/vul/2015-00626 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2014-2816 · Nota de Segurança
• http://secunia.com/advisories/60675 · Nota
• http://securityfocus.com/bid/69099 · Nota
• http://technet.microsoft.com/en-us/security/bulletin/ms14-050 · Nota
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-050 · Aviso do Fabricante