PT-2019-2246 · Microsoft · Sharepoint Server+1

Ivan Vagunin · Published 2019-05-14 · Updated 2020-08-24 · CVE-2019-0952

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft SharePoint Server (affected versions not specified)

Description A remote code execution issue exists due to the failure of Microsoft SharePoint Server to properly identify and filter unsafe ASP.Net web controls. This could allow an authenticated attacker to perform actions in the security context of the SharePoint application pool process by using a specially crafted page.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-254

Related Identifiers

BDU:2019-02017

CVE-2019-0952

Affected Products

Sharepoint Server

Sharepoint Foundation

References · 5

• https://osv.dev/vulnerability/CVE-2019-0952 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-0952 · Security Note
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0952 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-0952 · Security Note
• https://bdu.fstec.ru/vul/2019-02017 · Security Note