PT-2017-18447 · Microsoft · Sharepoint Server 2013 Service Pack 1+1

Publicado 2017-09-12 · Atualizado 2017-09-20 · CVE-2017-8629

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Microsoft SharePoint Server 2013 Service Pack 1

Description The issue arises when Microsoft SharePoint Server fails to properly sanitize a specially crafted web request to an affected SharePoint server. This allows an attacker to perform cross-site scripting attacks on affected systems and run script in the security context of the current user. The attacker could read content they are not authorized to read, use the victim's identity to take actions on the SharePoint site, such as changing permissions and deleting content, and inject malicious content in the user's browser.

Recommendations For Microsoft SharePoint Server 2013 Service Pack 1, update to a version that properly sanitizes web requests to prevent elevation of privilege and cross-site scripting attacks. As a temporary workaround, consider restricting access to sensitive areas of the SharePoint site to minimize the risk of exploitation.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2017-8629

Produtos afetados

Sharepoint Server 2013 Service Pack 1

Sharepoint Server

Referências · 6

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8629 · Aviso do Fabricante
• http://securitytracker.com/id/1039329 · Nota
• http://securityfocus.com/bid/100725 · Nota
• https://osv.dev/vulnerability/CVE-2017-8629 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8629 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2017-8629 · Nota de Segurança