PT-2021-1896 · Microsoft · Sharepoint Server+1

Cameron Vincent · Published 2021-01-12 · Updated 2024-10-08 · CVE-2021-1712

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:M/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft SharePoint Server (affected versions not specified) Microsoft SharePoint Foundation (affected versions not specified) Microsoft SharePoint Enterprise Server (affected versions not specified)

Description The issue is related to insecure privilege management in Microsoft SharePoint, allowing a remote attacker to elevate their privileges. This can potentially impact the system.

Recommendations For Microsoft SharePoint Server, update to a version that includes a fix for the insecure privilege management issue. For Microsoft SharePoint Foundation, apply configuration changes to restrict privilege elevation until a patch is available. For Microsoft SharePoint Enterprise Server, consider disabling vulnerable features or modules to minimize the risk of exploitation. As a temporary workaround, restrict access to sensitive areas of the system to prevent potential abuse of elevated privileges.

Fix

LPE

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

BDU:2021-00667

CVE-2021-1712

Affected Products

Sharepoint Server

Sharepoint Foundation

References · 10

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-1712 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-1712 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-1712 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-1712 · Security Note
• https://bdu.fstec.ru/vul/2021-00667 · Security Note
• https://t.me/cvenotify/65714 · Telegram Post
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-1712 · Note
• https://t.me/cvenotify/8460 · Telegram Post
• https://t.me/cvenotify/8686 · Telegram Post
• https://t.me/cibsecurity/21971 · Telegram Post