PT-2015-5408 · Microsoft · Sharepoint Foundation 2013+3

Publicado 2015-03-10 · Atualizado 2018-10-12 · CVE-2015-1636

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Baixa

Vetor base

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Microsoft SharePoint Foundation 2013 versions Gold and SP1 Microsoft SharePoint Server 2013 versions Gold and SP1

Description The issue allows remote authenticated users to inject arbitrary web script or HTML via a crafted request. An authenticated attacker could exploit these vulnerabilities by sending a specially crafted request to an affected SharePoint server, potentially leading to cross-site scripting attacks. This could enable the attacker to read unauthorized content, use the victim's identity to take actions on the SharePoint site, and inject malicious content in the victim's browser.

Recommendations For Microsoft SharePoint Foundation 2013 versions Gold and SP1, update to a version that includes the fix for this issue. For Microsoft SharePoint Server 2013 versions Gold and SP1, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to affected SharePoint servers to minimize the risk of exploitation.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2015-1636

Produtos afetados

Sharepoint Foundation 2013

Sharepoint Server 2013

Sharepoint Foundation

Sharepoint Server

Referências · 6

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-022 · Aviso do Fabricante
• http://technet.microsoft.com/security/bulletin/ms15-022 · Nota
• http://securitytracker.com/id/1031895 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-1636 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1636 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1636 · Nota