PT-2014-1682 · Microsoft · Sharepoint Foundation 2013+3

Published 2014-08-12 · Updated 2018-10-12 · CVE-2014-2816

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft SharePoint Server 2013 Gold and SP1 Microsoft SharePoint Foundation 2013 Gold and SP1

Description An elevation of privilege issue exists, allowing remote authenticated users to gain privileges via a specially crafted app that executes arbitrary code in the security context of the logged-on user. This is achieved by exploiting a vulnerability in the SharePoint extensibility model, enabling the execution of custom actions.

Recommendations For Microsoft SharePoint Server 2013 Gold and SP1, update to a version that includes the fix for this issue. For Microsoft SharePoint Foundation 2013 Gold and SP1, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting the use of custom apps and actions within the SharePoint extensibility model to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2015-00626

BDU:2015-00628

CVE-2014-2816

Affected Products

Sharepoint Foundation 2013

Sharepoint Server 2013

Sharepoint Foundation

Sharepoint Server

References · 10

• https://bdu.fstec.ru/vul/2015-00628 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2816 · Security Note
• https://bdu.fstec.ru/vul/2015-00626 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2014-2816 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-050 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2816 · Note
• http://securitytracker.com/id/1030720 · Note
• http://secunia.com/advisories/60675 · Note
• http://securityfocus.com/bid/69099 · Note
• http://technet.microsoft.com/en-us/security/bulletin/ms14-050 · Note