PT-2016-1060 · Microsoft · Sharepoint Foundation 2013 Sp1+3

Publicado 2016-01-12 · Atualizado 2018-10-12 · CVE-2015-6117

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Microsoft SharePoint Server 2013 SP1 Microsoft SharePoint Foundation 2013 SP1

Description The issue exists due to inadequate protection of the web page structure in Microsoft SharePoint, allowing a remote attacker to bypass existing access control policies and conduct cross-site scripting (XSS) attacks by modifying web elements. This could enable the attacker to read unauthorized content, perform actions on the SharePoint site as the user, such as changing permissions, deleting content, and injecting malicious content into the user's browser.

Recommendations For Microsoft SharePoint Server 2013 SP1, update the Access Control Policy configuration settings to enforce correct restrictions. For Microsoft SharePoint Foundation 2013 SP1, ensure that the ACP configuration settings are properly enforced to prevent security feature bypasses. As a temporary workaround, consider restricting access to sensitive web parts until a patch is available.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

BDU:2016-00127

CVE-2015-6117

Produtos afetados

Sharepoint Foundation 2013 Sp1

Sharepoint Server 2013 Sp1

Sharepoint Foundation

Sharepoint Server

Referências · 8

• http://technet.microsoft.com/security/bulletin/MS16-004 · Nota
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-004 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6117 · Nota
• https://bdu.fstec.ru/vul/2016-00127 · Nota de Segurança
• http://securitytracker.com/id/1034653 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6117 · Nota de Segurança
• http://technet.microsoft.com/security/bulletin/ms16-004 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-6117 · Nota de Segurança