PT-2018-9070 · Microsoft · Sharepoint Server 2016+4

Publicado 2018-01-09 · Atualizado 2019-10-03 · CVE-2018-0790

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Microsoft SharePoint Foundation 2010 Microsoft SharePoint Server 2013 Microsoft SharePoint Server 2016

Description: An elevation of privilege issue exists due to improper sanitization of specially crafted web requests to affected SharePoint servers. An authenticated attacker could exploit this by sending a specially crafted request, potentially leading to cross-site scripting attacks. These attacks could allow the attacker to read unauthorized content, use the victim's identity to change permissions and delete content, and inject malicious content into the user's browser.

Recommendations: For Microsoft SharePoint Foundation 2010, update to a version that includes the fix for this issue. For Microsoft SharePoint Server 2013, update to a version that includes the fix for this issue. For Microsoft SharePoint Server 2016, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to affected SharePoint servers to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2018-0790

Produtos afetados

Sharepoint Foundation 2010

Sharepoint Server 2013

Sharepoint Server 2016

Sharepoint Foundation

Sharepoint Server

Referências · 6

• http://securityfocus.com/bid/102391 · Nota
• http://securitytracker.com/id/1040150 · Nota
• https://osv.dev/vulnerability/CVE-2018-0790 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-0790 · Nota de Segurança
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0790 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0790 · Nota de Segurança