PT-2017-10477 · Microsoft · Sharepoint Server+2

Jörn Ahrens · Published 2017-05-09 · Updated 2017-05-23 · CVE-2017-0255

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Microsoft SharePoint Foundation 2013 SP1 SharePoint Server (affected versions not specified)

Description The issue arises when the software does not properly sanitize a specially crafted web request, allowing an elevation of privilege. An authenticated attacker could exploit this by sending a specially crafted request to an affected server, potentially leading to cross-site scripting attacks. These attacks could enable the attacker to read unauthorized content, use the victim's identity to take actions on the site, and inject malicious content into the victim's browser.

Recommendations For Microsoft SharePoint Foundation 2013 SP1, update to a version that includes the fix for this issue. For SharePoint Server, apply the necessary security patches to resolve the vulnerability. As a temporary workaround, consider restricting access to sensitive areas of the SharePoint site to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2017-0255

Affected Products

Sharepoint Foundation 2013 Sp1

Sharepoint Server

Sharepoint Foundation

References · 4

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0255 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-0255 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-0255 · Security Note
• http://securityfocus.com/bid/98107 · Note