PT-2017-18506 · Microsoft · Sharepoint Server+2

Publicado 2017-09-12 · Atualizado 2017-09-21 · CVE-2017-8745

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Microsoft SharePoint Foundation 2013 Service Pack 1 Microsoft SharePoint Server (affected versions not specified)

Description The issue arises from improper sanitization of specially crafted web requests to an affected SharePoint server. An authenticated attacker could exploit this by sending a specially crafted request, potentially leading to cross-site scripting attacks. This could allow the attacker to read unauthorized content, use the victim's identity to take actions on the SharePoint site, and inject malicious content into the user's browser.

Recommendations For Microsoft SharePoint Foundation 2013 Service Pack 1, update to a version that properly sanitizes web requests to prevent cross-site scripting attacks. For Microsoft SharePoint Server, apply configuration changes to ensure proper sanitization of web requests, such as validating user input and encoding output, until a fixed version is available. As a temporary workaround, consider restricting access to sensitive areas of the SharePoint site to minimize the risk of exploitation.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2017-8745

Produtos afetados

Sharepoint Foundation 2013 Service Pack 1

Sharepoint Server

Sharepoint Foundation

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2017-8745 · Nota de Segurança
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8745 · Aviso do Fabricante
• http://securityfocus.com/bid/100753 · Nota
• https://osv.dev/vulnerability/CVE-2017-8745 · Aviso do Fabricante