PT-2015-1080 · Microsoft · Sharepoint Foundation 2013 Sp1+3
Published
2015-04-14
·
Updated
2018-10-12
·
CVE-2015-1653
CVSS v2.0
4.3
Medium
| Vector | AV:N/AC:M/Au:N/C:N/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
Microsoft SharePoint Foundation 2013 SP1
Microsoft SharePoint Server 2013 SP1
Description
The issue is related to an elevation of privilege vulnerability that exists when SharePoint Server improperly sanitizes a specially crafted request to an affected SharePoint server. An authenticated attacker could exploit this vulnerability by sending a specially crafted request to an affected SharePoint server. The attacker who successfully exploited the vulnerability could then perform cross-site scripting attacks on affected systems and run script in the security context of the current user. These attacks could allow the attacker to read content that the attacker is not authorized to read, use the victim's identity to take actions on the SharePoint site on behalf of the victim, such as change permissions and delete content, and inject malicious content in the victim’s browser.
Recommendations
For Microsoft SharePoint Foundation 2013 SP1 and Microsoft SharePoint Server 2013 SP1, at the moment, there is no information about a newer version that contains a fix for this vulnerability.
RCE
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Sharepoint Foundation 2013 Sp1
Sharepoint Server 2013 Sp1
Sharepoint Foundation
Sharepoint Server