PT-2016-1060 · Microsoft · Sharepoint Foundation 2013 Sp1+3

Published 2016-01-12 · Updated 2018-10-12 · CVE-2015-6117

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Microsoft SharePoint Server 2013 SP1 Microsoft SharePoint Foundation 2013 SP1

Description The issue exists due to inadequate protection of the web page structure in Microsoft SharePoint, allowing a remote attacker to bypass existing access control policies and conduct cross-site scripting (XSS) attacks by modifying web elements. This could enable the attacker to read unauthorized content, perform actions on the SharePoint site as the user, such as changing permissions, deleting content, and injecting malicious content into the user's browser.

Recommendations For Microsoft SharePoint Server 2013 SP1, update the Access Control Policy configuration settings to enforce correct restrictions. For Microsoft SharePoint Foundation 2013 SP1, ensure that the ACP configuration settings are properly enforced to prevent security feature bypasses. As a temporary workaround, consider restricting access to sensitive web parts until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2016-00127

CVE-2015-6117

Affected Products

Sharepoint Foundation 2013 Sp1

Sharepoint Server 2013 Sp1

Sharepoint Foundation

Sharepoint Server

References · 8

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-004 · Vendor Advisory
• https://bdu.fstec.ru/vul/2016-00127 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6117 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2015-6117 · Security Note
• http://technet.microsoft.com/security/bulletin/MS16-004 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6117 · Note
• http://securitytracker.com/id/1034653 · Note
• http://technet.microsoft.com/security/bulletin/ms16-004 · Note