CVE-2020-17015
published 2020-11-11CVE-2020-17015: Microsoft SharePoint Server Spoofing Vulnerability
PriorityP431medium6.5CVSS 3.1
AVNACLPRNUIRSUCNIHAN
EPSS
2.05%
81.1th percentile
Microsoft SharePoint Server Spoofing Vulnerability
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | microsoft_sharepoint_enterprise_server_2016 | >= 16.0.0 < publication | publication |
| microsoft | microsoft_sharepoint_foundation_2013_service_pack_1 | >= 15.0.0 < publication | publication |
| microsoft | microsoft_sharepoint_server_2019 | >= 16.0.0 < publication | publication |
| microsoft | sharepoint_enterprise_server | — | — |
| microsoft | sharepoint_foundation | — | — |
| microsoft | sharepoint_server | — | — |
| mozilla | firefox | — | — |
| msrc | microsoft_sharepoint_enterprise_server_2016 | — | — |
| msrc | microsoft_sharepoint_foundation_2013_service_pack_1 | — | — |
| msrc | microsoft_sharepoint_server_2019 | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
vendor_msrc4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Microsoft
Microsoft SharePoint Server Spoofing Vulnerability
vendor_msrc·2020-11-10·CVSS 4.3
CVE-2020-17015 [MEDIUM] Microsoft SharePoint Server Spoofing Vulnerability
Microsoft SharePoint Server Spoofing Vulnerability
Microsoft Office SharePoint: Microsoft Office SharePoint
Microsoft: Microsoft
Customer Action Required: Yes
Impact: Spoofing
Exploit Status: Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely;Older Software Release:Exploitation Less Likely;DOS:N/A
Reference: https://www.microsoft.com/download/details.aspx?familyid=9a9c9608-da2b-47c6-90f6-20ef0bf01896
Reference: https://support.microsoft.com/help/4486717
Reference: https://www.microsoft.com/download/details.aspx?familyid=466c8e2f-7b95-4a9a-94a7-17ee57f8d01e
Reference: https://support.microsoft.com/help/4486714
Reference: https://www.microsoft.com/download/details.aspx?familyid=53ca5d28-e62f-4adf-8232-01c523626d2f
Mozilla
Mozilla Foundation Security Advisory 2020-01: CVE-2019-17015
vendor_mozilla·CVSS 8.8
CVE-2019-17015 [HIGH] Mozilla Foundation Security Advisory 2020-01: CVE-2019-17015
Mozilla Foundation Security Advisory 2020-01
CVE: CVE-2019-17015
Product: Firefox
Impact: high
Fixed in: Firefox 72
Mozilla
Mozilla Foundation Security Advisory 2020-02: CVE-2019-17015
vendor_mozilla·CVSS 8.8
CVE-2019-17015 [HIGH] Mozilla Foundation Security Advisory 2020-02: CVE-2019-17015
Mozilla Foundation Security Advisory 2020-02
CVE: CVE-2019-17015
Product: Firefox ESR
Impact: high
Fixed in: Firefox ESR 68.4
Mozilla
Mozilla Foundation Security Advisory 2020-04: CVE-2019-17015
vendor_mozilla·CVSS 8.8
CVE-2019-17015 [HIGH] Mozilla Foundation Security Advisory 2020-04: CVE-2019-17015
Mozilla Foundation Security Advisory 2020-04
CVE: CVE-2019-17015
Product: Thunderbird
Impact: high
Fixed in: Thunderbird 68.4.1
GHSA
GHSA-6m9m-j2hw-pppg: Microsoft SharePoint Spoofing Vulnerability This CVE ID is unique from CVE-2020-17016, CVE-2020-17060
ghsa_unreviewed·2022-05-24·CVSS 8.0
CVE-2020-17015 [HIGH] CWE-20 GHSA-6m9m-j2hw-pppg: Microsoft SharePoint Spoofing Vulnerability This CVE ID is unique from CVE-2020-17016, CVE-2020-17060
Microsoft SharePoint Spoofing Vulnerability This CVE ID is unique from CVE-2020-17016, CVE-2020-17060.
GHSA
GHSA-r2cr-p8cx-757w: Microsoft SharePoint Spoofing Vulnerability This CVE ID is unique from CVE-2020-17015, CVE-2020-17016
ghsa_unreviewed·2022-05-24·CVSS 4.3
CVE-2020-17060 [MEDIUM] CWE-20 GHSA-r2cr-p8cx-757w: Microsoft SharePoint Spoofing Vulnerability This CVE ID is unique from CVE-2020-17015, CVE-2020-17016
Microsoft SharePoint Spoofing Vulnerability This CVE ID is unique from CVE-2020-17015, CVE-2020-17016.
GHSA
GHSA-2wcf-8w35-jp7x: Microsoft SharePoint Spoofing Vulnerability This CVE ID is unique from CVE-2020-17015, CVE-2020-17060
ghsa_unreviewed·2022-05-24·CVSS 4.3
CVE-2020-17016 [MEDIUM] CWE-20 GHSA-2wcf-8w35-jp7x: Microsoft SharePoint Spoofing Vulnerability This CVE ID is unique from CVE-2020-17015, CVE-2020-17060
Microsoft SharePoint Spoofing Vulnerability This CVE ID is unique from CVE-2020-17015, CVE-2020-17060.
No detection rules found.
No public exploits indexed.
Qualys
November 2020 Patch Tuesday – 112 Vulnerabilities, 17 Critical, Windows Codecs, Network File System, Workstation, Adobe | Qualys
blogs_qualys·2020-11-10·CVSS 5.3
[MEDIUM] November 2020 Patch Tuesday – 112 Vulnerabilities, 17 Critical, Windows Codecs, Network File System, Workstation, Adobe | Qualys
This month’s Microsoft Patch Tuesday addresses 112 vulnerabilities with 17 of them labeled as Critical. The 17 Critical vulnerabilities cover Windows Codecs, Network File System, Sharepoint, Windows Print Spooler, and several other workstation vulnerabilities. Adobe released patches today for Adobe Connect and Adobe Reader for Android.
### Workstation Patches
The Windows Codecs, GDI+, Browser, Office and Exchange Server vulnerabilities should be prioritized for workstation-type devices, meaning any system that is used for email or to access the internet via a browser. This includes multi-user servers that are used as remote desktops for users.
### SharePoint RCE
Microsoft patched six vulnerabilities in SharePoint, and one of them could lead to Remote Code Execution (CVE-2020-17061). Th
Qualys
November 2020 Patch Tuesday – 112 Vulnerabilities, 17 Critical, Windows Codecs, Network File System, Workstation, Adobe
blogs_qualys·2020-11-10·CVSS 5.3
[MEDIUM] November 2020 Patch Tuesday – 112 Vulnerabilities, 17 Critical, Windows Codecs, Network File System, Workstation, Adobe
This month’s Microsoft Patch Tuesday addresses 112 vulnerabilities with 17 of them labeled as Critical. The 17 Critical vulnerabilities cover Windows Codecs, Network File System, Sharepoint, Windows Print Spooler, and several other workstation vulnerabilities. Adobe released patches today for Adobe Connect and Adobe Reader for Android.
## Workstation Patches
The Windows Codecs, GDI+, Browser, Office and Exchange Server vulnerabilities should be prioritized for workstation-type devices, meaning any system that is used for email or to access the internet via a browser. This includes multi-user servers that are used as remote desktops for users.
## SharePoint RCE
Microsoft patched six vulnerabilities in SharePoint, and one of them could lead to Remote Code Execution ( CVE-2020-17061 ). Th
2020-11-11
Published