PT-2019-4445 · Microsoft · Sharepoint Foundation+1

Published 2019-12-17 · Updated 2020-01-14 · CVE-2019-1491

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Microsoft SharePoint Server (affected versions not specified) Microsoft SharePoint Enterprise Server (affected versions not specified) Microsoft SharePoint Foundation (affected versions not specified)

Description An information disclosure issue exists due to incorrect restriction of a directory path name with limited access. This could allow a remote attacker to disclose protected information. The attacker would need to send a specially crafted request to a susceptible SharePoint Server instance to exploit the vulnerability, potentially allowing them to read arbitrary files on the server.

Recommendations For Microsoft SharePoint Server, consider restricting access to sensitive files and directories until a fix is available. For Microsoft SharePoint Enterprise Server, restrict access to vulnerable components to minimize the risk of exploitation. For Microsoft SharePoint Foundation, avoid using vulnerable functions or modules that could lead to information disclosure until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2020-00231

CVE-2019-1491

Affected Products

Sharepoint Server

Sharepoint Foundation

References · 5

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1491 · Security Note
• https://bdu.fstec.ru/vul/2020-00231 · Security Note
• https://cybersecurity-help.cz/vdb/SB2020010702 · Note
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1491 · Note
• https://t.me/cibsecurity/8753 · Telegram Post