PT-2015-5408 · Microsoft · Sharepoint Foundation 2013+3

Published 2015-03-10 · Updated 2018-10-12 · CVE-2015-1636

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Microsoft SharePoint Foundation 2013 versions Gold and SP1 Microsoft SharePoint Server 2013 versions Gold and SP1

Description The issue allows remote authenticated users to inject arbitrary web script or HTML via a crafted request. An authenticated attacker could exploit these vulnerabilities by sending a specially crafted request to an affected SharePoint server, potentially leading to cross-site scripting attacks. This could enable the attacker to read unauthorized content, use the victim's identity to take actions on the SharePoint site, and inject malicious content in the victim's browser.

Recommendations For Microsoft SharePoint Foundation 2013 versions Gold and SP1, update to a version that includes the fix for this issue. For Microsoft SharePoint Server 2013 versions Gold and SP1, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to affected SharePoint servers to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2015-1636

Affected Products

Sharepoint Foundation 2013

Sharepoint Server 2013

Sharepoint Foundation

Sharepoint Server

References · 6

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-022 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-1636 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1636 · Security Note
• http://technet.microsoft.com/security/bulletin/ms15-022 · Note
• http://securitytracker.com/id/1031895 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1636 · Note