PT-2017-12316 · Microsoft · Sharepoint Enterprise Server 2016+1

Publicado 2017-12-12 · Atualizado 2019-10-03 · CVE-2017-11936

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Microsoft SharePoint Enterprise Server 2016

Description The issue arises from the way web requests are handled. An elevation of privilege issue exists due to improper sanitization of specially crafted web requests to an affected SharePoint server. An authenticated attacker could exploit this by sending a crafted request, potentially leading to cross-site scripting attacks. This could allow the attacker to read unauthorized content, use the victim's identity to take actions such as changing permissions and deleting content, and inject malicious content into the user's browser.

Recommendations For Microsoft SharePoint Enterprise Server 2016, apply the necessary security updates to resolve the issue. As a temporary workaround, consider restricting access to sensitive areas of the SharePoint site to minimize the risk of exploitation. Avoid using the affected SharePoint server for sensitive operations until the issue is resolved.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2017-11936

Produtos afetados

Sharepoint Enterprise Server 2016

Sharepoint Server

Referências · 6

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11936 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11936 · Nota de Segurança
• http://securityfocus.com/bid/102068 · Nota
• http://securitytracker.com/id/1039995 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-11936 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-11936 · Aviso do Fabricante