PT-2022-1656 · Microsoft · Sharepoint Server Subscription Edition+1

Malacupa · Published 2022-02-08 · Updated 2023-06-29 · CVE-2022-21987

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:M/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft SharePoint Server (affected versions not specified) Microsoft SharePoint Enterprise Server (affected versions not specified) Microsoft SharePoint Server Subscription Edition (affected versions not specified)

Description The issue is related to errors in the user interface's information representation. It may allow a remote attacker to perform a spoofing attack.

Recommendations For Microsoft SharePoint Server, consider restricting access to sensitive areas of the system until a fix is available. For Microsoft SharePoint Enterprise Server, restrict access to the user interface to minimize the risk of exploitation. For Microsoft SharePoint Server Subscription Edition, avoid using the system for critical operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

UI Misrepresentation of Critical Information

Weakness Enumeration

CWE-451

Related Identifiers

BDU:2022-00906

CVE-2022-21987

Affected Products

Sharepoint Server

Sharepoint Server Subscription Edition

References · 6

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21987 · Security Note
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21987 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-00906 · Security Note
• https://osv.dev/vulnerability/CVE-2022-21987 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-21987 · Security Note
• https://t.me/cibsecurity/37099 · Telegram Post