PT-2021-6180 · Microsoft · Sharepoint Server+1

Hph0Var + 1 · Published 2021-12-14 · Updated 2023-12-28 · CVE-2021-42320

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:M/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft SharePoint Server (affected versions not specified) Microsoft SharePoint Server Subscription Edition (affected versions not specified) Microsoft SharePoint Enterprise Server (affected versions not specified)

Description The issue is related to a spoofing vulnerability that allows for authentication bypass. This can enable a remote attacker to conduct spoofing attacks.

Recommendations For Microsoft SharePoint Server, consider restricting access to sensitive areas of the system until a fix is available. For Microsoft SharePoint Server Subscription Edition, restrict access to vulnerable modules to minimize the risk of exploitation. For Microsoft SharePoint Enterprise Server, as a temporary workaround, consider disabling any functionality related to authentication until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Spoofing

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-290

Related Identifiers

BDU:2022-01096

CVE-2021-42320

Affected Products

Sharepoint Server

Sharepoint Server Subscription Edition

References · 10

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42320 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-42320 · Security Note
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42320 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42320 · Security Note
• https://osv.dev/vulnerability/CVE-2021-42320 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-01096 · Security Note
• https://t.me/cibsecurity/34021 · Telegram Post
• https://t.me/cibsecurity/34039 · Telegram Post
• https://t.me/cvenotify/24781 · Telegram Post
• https://twitter.com/Esparta6108713/status/1740173949131210872 · Twitter Post