PT-2022-2757 · Microsoft · Sharepoint Server Subscription Edition+2

Published 2022-02-05 · Updated 2023-06-29 · CVE-2022-24472

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft SharePoint Server (affected versions not specified) Microsoft SharePoint Server Subscription Edition (affected versions not specified) Microsoft SharePoint Enterprise Server (affected versions not specified) Microsoft SharePoint Foundation (affected versions not specified)

Description The issue is related to errors in the representation of information by the user interface. It may allow a remote attacker to conduct spoofing attacks using a specially crafted server resource or website. The vulnerability can be exploited to affect the system.

Recommendations For Microsoft SharePoint Server, consider restricting access to vulnerable user interface components until a patch is available. For Microsoft SharePoint Server Subscription Edition, restrict access to vulnerable modules to minimize the risk of exploitation. For Microsoft SharePoint Enterprise Server, avoid using vulnerable features in the affected system until the issue is resolved. For Microsoft SharePoint Foundation, as a temporary workaround, consider disabling vulnerable functions until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

UI Misrepresentation of Critical Information

Weakness Enumeration

CWE-451

Related Identifiers

BDU:2022-03276

CVE-2022-24472

Affected Products

Sharepoint Server

Sharepoint Foundation

Sharepoint Server Subscription Edition

References · 9

• https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-24472 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-03276 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-24472 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24472 · Security Note
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24472 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-24472 · Vendor Advisory
• https://vuldb.com/?id.197021 · Note
• https://cybersecurity-help.cz/vdb/SB2022041247 · Note
• https://t.me/cibsecurity/40908 · Telegram Post