PT-2020-4316 · Microsoft · Sharepoint Server+1

Mwulftange · Published 2020-10-13 · Updated 2023-12-31 · CVE-2020-16942

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Medium

Base vector

AV:L/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Microsoft SharePoint Server (affected versions not specified) Microsoft SharePoint Foundation (affected versions not specified) Microsoft SharePoint Enterprise Server (affected versions not specified)

Description: An information disclosure issue exists when Microsoft SharePoint Server improperly discloses its folder structure when rendering specific web pages. This could allow an attacker to view the folder path of scripts loaded on the page. To exploit this issue, an attacker would require access to the specific SharePoint page affected. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited.

Recommendations: For Microsoft SharePoint Server, update the software to correct how scripts are referenced on some SharePoint pages. For Microsoft SharePoint Foundation, update the software to correct how scripts are referenced on some SharePoint pages. For Microsoft SharePoint Enterprise Server, update the software to correct how scripts are referenced on some SharePoint pages. As a temporary workaround, consider restricting access to the affected SharePoint pages until a patch is available.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2020-04813

CVE-2020-16942

Affected Products

Sharepoint Server

Sharepoint Foundation

References · 5

• https://bdu.fstec.ru/vul/2020-04813 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16942 · Security Note
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16942 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-16942 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-16942 · Security Note