PT-2017-10477 · Microsoft · Sharepoint Server+2

Jörn Ahrens · Publicado 2017-05-09 · Atualizado 2017-05-23 · CVE-2017-0255

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Microsoft SharePoint Foundation 2013 SP1 SharePoint Server (affected versions not specified)

Description The issue arises when the software does not properly sanitize a specially crafted web request, allowing an elevation of privilege. An authenticated attacker could exploit this by sending a specially crafted request to an affected server, potentially leading to cross-site scripting attacks. These attacks could enable the attacker to read unauthorized content, use the victim's identity to take actions on the site, and inject malicious content into the victim's browser.

Recommendations For Microsoft SharePoint Foundation 2013 SP1, update to a version that includes the fix for this issue. For SharePoint Server, apply the necessary security patches to resolve the vulnerability. As a temporary workaround, consider restricting access to sensitive areas of the SharePoint site to minimize the risk of exploitation.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2017-0255

Produtos afetados

Sharepoint Foundation 2013 Sp1

Sharepoint Server

Sharepoint Foundation

Referências · 4

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0255 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-0255 · Aviso do Fabricante
• http://securityfocus.com/bid/98107 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-0255 · Nota de Segurança