PT-2020-2848 · Microsoft · Sharepoint Server

Published 2020-06-09 · Updated 2021-07-21 · CVE-2020-1295

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft SharePoint Server (affected versions not specified) Microsoft SharePoint Enterprise Server (affected versions not specified)

Description The issue is related to insufficient access controls in Microsoft SharePoint, allowing a remote attacker to elevate their privileges using a specially crafted request. This could enable the attacker to impersonate another user of the SharePoint server. An authenticated attacker would need to send a specially crafted request to an affected server to exploit this issue.

Recommendations For Microsoft SharePoint Server, apply the necessary security updates or patches to resolve the issue. For Microsoft SharePoint Enterprise Server, apply the necessary security updates or patches to resolve the issue. As a temporary workaround, consider restricting access to sensitive areas of the SharePoint server to minimize the risk of exploitation.

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

BDU:2020-03002

CVE-2020-1295

Affected Products

Sharepoint Server

References · 5

• https://osv.dev/vulnerability/CVE-2020-1295 · Vendor Advisory
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1295 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-03002 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-1295 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1295 · Security Note