PT-2018-9114 · Microsoft · Sharepoint Server 2016+1

Ashar Javed · Publicado 2018-02-13 · Atualizado 2018-03-07 · CVE-2018-0869

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Microsoft SharePoint Server 2016

Description: The issue arises from how web requests are handled, allowing an elevation of privilege. An authenticated attacker could exploit this by sending a specially crafted request to an affected server, potentially leading to cross-site scripting attacks. This could enable the attacker to read unauthorized content, use the victim's identity to change permissions or delete content, and inject malicious content into the user's browser.

Recommendations: For Microsoft SharePoint Server 2016, update the software to a version that properly sanitizes web requests to prevent elevation of privilege attacks. As a temporary workaround, consider restricting access to sensitive areas of the SharePoint site to minimize the risk of exploitation.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2018-0869

Produtos afetados

Sharepoint Server 2016

Sharepoint Server

Referências · 6

• https://osv.dev/vulnerability/CVE-2018-0869 · Aviso do Fabricante
• http://securitytracker.com/id/1040376 · Nota
• http://securityfocus.com/bid/102963 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-0869 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0869 · Nota de Segurança
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0869 · Aviso do Fabricante