CVE-2019-0952 — Microsoft Sharepoint Enterprise Server vulnerability

4 documents4 sources

Severity

8.8HIGHNVD

EPSS

36.1%

top 2.90%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Microsoft Sharepoint Enterprise Server Microsoft Sharepoint Foundation Microsoft Sharepoint Enterprise Server +1 more

Timeline

PublishedMay 16

Latest updateMay 24

Description

A remote code execution vulnerability exists in Microsoft SharePoint Server when it fails to properly identify and filter unsafe ASP.Net web controls, aka 'Microsoft SharePoint Server Remote Code Execution Vulnerability'.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages4 packages

▶NVDmicrosoft/sharepoint_enterprise_server2016

▶CVEListV5microsoft/microsoft_sharepoint_enterprise_server2016

▶NVDmicrosoft/sharepoint_foundation2013

▶CVEListV5microsoft/microsoft_sharepoint_foundation2013 Service Pack 1

Patches

Patch: portal.msrc.microsoft.com ↗Patch: portal.msrc.microsoft.com ↗

🔴Vulnerability Details

GHSA

GHSA-qrf4-v7w7-vc33: A remote code execution vulnerability exists in Microsoft SharePoint Server when it fails to properly identify and filter unsafe ASP↗2022-05-24

▶

CVEList

CVE-2019-0952: A remote code execution vulnerability exists in Microsoft SharePoint Server when it fails to properly identify and filter unsafe ASP↗2019-05-16

▶

📋Vendor Advisories

Microsoft

Microsoft SharePoint Server Remote Code Execution Vulnerability↗2019-05-14

▶