PT-2017-18447 · Microsoft · Sharepoint Server 2013 Service Pack 1+1

Published 2017-09-12 · Updated 2017-09-20 · CVE-2017-8629

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Microsoft SharePoint Server 2013 Service Pack 1

Description The issue arises when Microsoft SharePoint Server fails to properly sanitize a specially crafted web request to an affected SharePoint server. This allows an attacker to perform cross-site scripting attacks on affected systems and run script in the security context of the current user. The attacker could read content they are not authorized to read, use the victim's identity to take actions on the SharePoint site, such as changing permissions and deleting content, and inject malicious content in the user's browser.

Recommendations For Microsoft SharePoint Server 2013 Service Pack 1, update to a version that properly sanitizes web requests to prevent elevation of privilege and cross-site scripting attacks. As a temporary workaround, consider restricting access to sensitive areas of the SharePoint site to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2017-8629

Affected Products

Sharepoint Server 2013 Service Pack 1

Sharepoint Server

References · 6

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8629 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-8629 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8629 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-8629 · Security Note
• http://securitytracker.com/id/1039329 · Note
• http://securityfocus.com/bid/100725 · Note