PT-2018-1079 · Microsoft · Sharepoint Server+1

Ashar Javed · Publicado 2018-01-09 · Atualizado 2019-10-03 · CVE-2018-0789

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft SharePoint Foundation version 2010 Microsoft SharePoint Server versions 2013 through 2016

Description The issue is related to the handling of web requests and insufficient access control, allowing an elevation of privilege. An authenticated attacker could exploit this by sending a specially crafted HTTP request to an affected server, potentially leading to cross-site scripting attacks. This could enable the attacker to read unauthorized content, use the victim's identity to change permissions, delete content, and inject malicious content into the user's browser.

Recommendations For Microsoft SharePoint Foundation 2010, update to a version that includes the fix for this issue. For Microsoft SharePoint Server 2013, apply the necessary patch or update to resolve the vulnerability. For Microsoft SharePoint Server 2016, consider disabling the handling of specially crafted web requests until a patch is available, and apply the necessary update once it is released.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

BDU:2018-00422

CVE-2018-0789

Produtos afetados

Sharepoint Foundation

Sharepoint Server

Referências · 7

• https://osv.dev/vulnerability/CVE-2018-0789 · Aviso do Fabricante
• http://securitytracker.com/id/1040150 · Nota
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0789 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0789 · Nota de Segurança
• https://bdu.fstec.ru/vul/2018-00422 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2018-0789 · Nota de Segurança
• http://securityfocus.com/bid/102394 · Nota