CVE-2020-16941: An information disclosure vulnerability exists when Microsoft SharePoint Server improperly discloses its folder structure when rendering specific web pages. An…

PriorityP424medium5.5CVSS 3.1

AVLACLPRLUINSUCHINAN

EPSS

0.90%

59.2th percentile

An information disclosure vulnerability exists when Microsoft SharePoint Server improperly discloses its folder structure when rendering specific web pages. An attacker who took advantage of this information disclosure could view the folder path of scripts loaded on the page. To take advantage of the vulnerability, an attacker would require access to the specific SharePoint page affected by this vulnerability. The security update addresses the vulnerability by correcting how scripts are referenced on some SharePoint pages.

Affected

12 ranges

Vendor	Product	Version range	Fixed in
microsoft	microsoft_sharepoint_enterprise_server_2016	>= 16.0.0 < publication	publication
microsoft	microsoft_sharepoint_foundation_2010_service_pack_2	>= 13.0.0 < publication	publication
microsoft	microsoft_sharepoint_foundation_2013_service_pack_1	>= 15.0.0 < publication	publication
microsoft	microsoft_sharepoint_server_2019	>= 16.0.0 < publication	publication
microsoft	sharepoint_enterprise_server	—	—
microsoft	sharepoint_foundation	—	—
microsoft	sharepoint_foundation	—	—
microsoft	sharepoint_server	—	—
msrc	microsoft_sharepoint_enterprise_server_2016	—	—
msrc	microsoft_sharepoint_foundation_2010_service_pack_2	—	—
msrc	microsoft_sharepoint_foundation_2013_service_pack_1	—	—
msrc	microsoft_sharepoint_server_2019	—	—

CVSS provenance

nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

nvdv2.02.1LOWAV:L/AC:L/Au:N/C:P/I:N/A:N

vendor_msrc4.1MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.