PT-2020-4036 · Microsoft · Sharepoint Server+1

Mr_Me + 1 · Published 2020-09-08 · Updated 2023-12-31 · CVE-2020-1440

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions: Microsoft SharePoint Server (affected versions not specified) Microsoft SharePoint Foundation (affected versions not specified) Microsoft SharePoint Enterprise Server (affected versions not specified)

Description: A tampering issue exists due to Microsoft SharePoint Server's failure to properly handle profile data. This could allow an attacker to modify a targeted user's profile data. To exploit this, an attacker must be authenticated on the affected server and send a specially modified request targeting a specific user.

Recommendations: For Microsoft SharePoint Server, update the software to the latest version that includes the security update, which modifies how profile data is handled. For Microsoft SharePoint Foundation, apply the security update that addresses the vulnerability by improving input validation. For Microsoft SharePoint Enterprise Server, consider restricting access to profile data until a patch is available. As a temporary workaround, consider disabling the modification of profile data on the server until a patch is available.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2020-04436

CVE-2020-1440

Affected Products

Sharepoint Server

Sharepoint Foundation

References · 5

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1440 · Security Note
• https://bdu.fstec.ru/vul/2020-04436 · Security Note
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1440 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-1440 · Security Note
• https://osv.dev/vulnerability/CVE-2020-1440 · Vendor Advisory