CVE-2020-16979
published 2020-11-11CVE-2020-16979: Microsoft SharePoint Information Disclosure Vulnerability
PriorityP334medium6.5CVSS 3.1
AVNACLPRLUINSUCHINAN
EPSS
2.90%
85.5th percentile
Microsoft SharePoint Information Disclosure Vulnerability
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | microsoft_sharepoint_enterprise_server_2016 | >= 16.0.0 < publication | publication |
| microsoft | microsoft_sharepoint_foundation_2013_service_pack_1 | >= 15.0.0 < publication | publication |
| microsoft | microsoft_sharepoint_server_2019 | >= 16.0.0 < publication | publication |
| microsoft | sharepoint_enterprise_server | — | — |
| microsoft | sharepoint_foundation | — | — |
| microsoft | sharepoint_server | — | — |
| msrc | microsoft_sharepoint_enterprise_server_2016 | — | — |
| msrc | microsoft_sharepoint_foundation_2013_service_pack_1 | — | — |
| msrc | microsoft_sharepoint_server_2019 | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:P/I:N/A:N
vendor_msrc5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-7gmj-6jcg-6xqh: Microsoft SharePoint Information Disclosure Vulnerability This CVE ID is unique from CVE-2020-16979
ghsa_unreviewed·2022-05-24·CVSS 5.3
CVE-2020-17017 [MEDIUM] CWE-200 GHSA-7gmj-6jcg-6xqh: Microsoft SharePoint Information Disclosure Vulnerability This CVE ID is unique from CVE-2020-16979
Microsoft SharePoint Information Disclosure Vulnerability This CVE ID is unique from CVE-2020-16979.
GHSA
GHSA-h5f7-h4f2-6vf6: Microsoft SharePoint Information Disclosure Vulnerability This CVE ID is unique from CVE-2020-17017
ghsa_unreviewed·2022-05-24·CVSS 5.3
CVE-2020-16979 [MEDIUM] GHSA-h5f7-h4f2-6vf6: Microsoft SharePoint Information Disclosure Vulnerability This CVE ID is unique from CVE-2020-17017
Microsoft SharePoint Information Disclosure Vulnerability This CVE ID is unique from CVE-2020-17017.
Microsoft
Microsoft SharePoint Information Disclosure Vulnerability
vendor_msrc·2020-11-10·CVSS 5.3
CVE-2020-16979 [MEDIUM] Microsoft SharePoint Information Disclosure Vulnerability
Microsoft SharePoint Information Disclosure Vulnerability
FAQ: What type of information could be disclosed by this vulnerability?
The type of information that could be disclosed if an attacker successfully exploited this vulnerability is unauthorized file system access - reading from the file system.
Microsoft Office SharePoint: Microsoft Office SharePoint
Microsoft: Microsoft
Customer Action Required: Yes
Impact: Information Disclosure
Exploit Status: Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely;Older Software Release:Exploitation Less Likely;DOS:N/A
Reference: https://www.microsoft.com/download/details.aspx?familyid=9a9c9608-da2b-47c6-90f6-20ef0bf01896
Reference: https://support.microsoft.com/help/4486717
Reference: https://www.microsoft.co
No detection rules found.
No public exploits indexed.
Qualys
November 2020 Patch Tuesday – 112 Vulnerabilities, 17 Critical, Windows Codecs, Network File System, Workstation, Adobe | Qualys
blogs_qualys·2020-11-10·CVSS 5.3
[MEDIUM] November 2020 Patch Tuesday – 112 Vulnerabilities, 17 Critical, Windows Codecs, Network File System, Workstation, Adobe | Qualys
This month’s Microsoft Patch Tuesday addresses 112 vulnerabilities with 17 of them labeled as Critical. The 17 Critical vulnerabilities cover Windows Codecs, Network File System, Sharepoint, Windows Print Spooler, and several other workstation vulnerabilities. Adobe released patches today for Adobe Connect and Adobe Reader for Android.
### Workstation Patches
The Windows Codecs, GDI+, Browser, Office and Exchange Server vulnerabilities should be prioritized for workstation-type devices, meaning any system that is used for email or to access the internet via a browser. This includes multi-user servers that are used as remote desktops for users.
### SharePoint RCE
Microsoft patched six vulnerabilities in SharePoint, and one of them could lead to Remote Code Execution (CVE-2020-17061). Th
Qualys
November 2020 Patch Tuesday – 112 Vulnerabilities, 17 Critical, Windows Codecs, Network File System, Workstation, Adobe
blogs_qualys·2020-11-10·CVSS 5.3
[MEDIUM] November 2020 Patch Tuesday – 112 Vulnerabilities, 17 Critical, Windows Codecs, Network File System, Workstation, Adobe
This month’s Microsoft Patch Tuesday addresses 112 vulnerabilities with 17 of them labeled as Critical. The 17 Critical vulnerabilities cover Windows Codecs, Network File System, Sharepoint, Windows Print Spooler, and several other workstation vulnerabilities. Adobe released patches today for Adobe Connect and Adobe Reader for Android.
## Workstation Patches
The Windows Codecs, GDI+, Browser, Office and Exchange Server vulnerabilities should be prioritized for workstation-type devices, meaning any system that is used for email or to access the internet via a browser. This includes multi-user servers that are used as remote desktops for users.
## SharePoint RCE
Microsoft patched six vulnerabilities in SharePoint, and one of them could lead to Remote Code Execution ( CVE-2020-17061 ). Th
2020-11-11
Published