PT-2016-1235 · Microsoft · Sharepoint Foundation 2013 Sp1+1

Published 2016-02-09 · Updated 2018-10-12 · CVE-2016-0039

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Microsoft SharePoint Foundation 2013 SP1

Description A cross-site scripting (XSS) issue exists due to inadequate protection of the web page structure, allowing remote attackers to inject arbitrary web script or HTML via a crafted request. This can be exploited by an authenticated attacker sending a specially crafted request to an affected SharePoint server, potentially leading to cross-site scripting attacks. These attacks could enable the attacker to read unauthorized content, use the victim's identity to take actions on the SharePoint site, and inject malicious content into the victim's browser.

Recommendations For Microsoft SharePoint Foundation 2013 SP1, apply the necessary security updates to resolve the issue. As a temporary workaround, consider restricting access to sensitive areas of the SharePoint site and implementing additional security measures to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2016-00496

CVE-2016-0039

Affected Products

Sharepoint Foundation 2013 Sp1

Sharepoint Foundation

References · 6

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-015 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-0039 · Security Note
• https://osv.dev/vulnerability/CVE-2016-0039 · Vendor Advisory
• https://bdu.fstec.ru/vul/2016-00496 · Security Note
• http://technet.microsoft.com/security/bulletin/MS16-015 · Note
• http://securitytracker.com/id/1034975 · Note