PT-2016-1050 · Microsoft · Sharepoint Server 2013 Sp1+3
Published
2016-01-12
·
Updated
2018-10-12
·
CVE-2016-0011
CVSS v3.1
5.4
Medium
| Vector | AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Microsoft SharePoint Server 2013 SP1
Microsoft SharePoint Foundation 2013 SP1
Description
The issue allows remote authenticated users to bypass intended Access Control Policy restrictions. This can be achieved by modifying a webpart, which can lead to cross-site scripting (XSS) attacks. The vulnerability exists due to inadequate protection of the webpage structure, enabling an attacker to circumvent existing access control policies. As a result, an attacker can read unauthorized content, perform actions on the SharePoint site as the user, such as changing permissions, deleting content, and injecting malicious content into the user's browser.
Recommendations
For Microsoft SharePoint Server 2013 SP1, ensure Access Control Policy configuration settings are correctly enforced to prevent security feature bypasses.
For Microsoft SharePoint Foundation 2013 SP1, apply the same measures as for Microsoft SharePoint Server 2013 SP1 to mitigate the risk of exploitation.
As a temporary workaround, consider restricting modifications to webparts until a patch is available.
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Sharepoint Foundation 2013 Sp1
Sharepoint Server 2013 Sp1
Sharepoint Foundation
Sharepoint Server