PT-2024-6284 · Microsoft · Sharepoint Server

Chudypb + 1 · Published 2024-09-10 · Updated 2025-11-24 · CVE-2024-38018

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft SharePoint Server (affected versions not specified)

Description The software contains a remote code execution issue stemming from flaws in the deserialization mechanism. Exploitation may allow an attacker to execute arbitrary code remotely by submitting a specially crafted file. The issue affects fully patched versions of SharePoint 2013 and SharePoint 2010, which are end-of-life and will not receive a fix. The issue is implemented in https://t.co/9BofGcFaWh.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2024-07232

CVE-2024-38018

ZDI-24-1204

Affected Products

Sharepoint Server

References · 22

• https://zerodayinitiative.com/advisories/ZDI-24-1204 · Security Note
• https://osv.dev/vulnerability/CVE-2024-38018 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-07232 · Security Note
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38018 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-38018 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-38018 · Security Note
• https://t.me/cvenotify/95091 · Telegram Post
• https://twitter.com/chudyPB/status/1854144812556935297 · Twitter Post
• https://twitter.com/chudyPB/status/1945420677109936582 · Twitter Post
• https://twitter.com/chudyPB/status/1952328875125744124 · Twitter Post
• https://t.me/CSIRT_italia/2931 · Telegram Post
• https://vuldb.com/ru/?id.277027 · Note
• https://twitter.com/irsdl/status/1951403259081396426 · Twitter Post
• https://reddit.com/r/CVEWatch/comments/1mgfjzq/top_10_trending_cves_03082025 · Reddit Post
• https://reddit.com/r/CVEWatch/comments/1mh9d03/top_10_trending_cves_04082025 · Reddit Post