CVE-2020-17016
published 2020-11-11CVE-2020-17016: Microsoft SharePoint Server Spoofing Vulnerability
PriorityP346high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
EPSS
3.20%
88.1th percentile
Microsoft SharePoint Server Spoofing Vulnerability
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | microsoft_sharepoint_enterprise_server_2013_service_pack_1 | >= 15.0.0 < publication | publication |
| microsoft | microsoft_sharepoint_enterprise_server_2016 | >= 16.0.0 < publication | publication |
| microsoft | microsoft_sharepoint_server_2010_service_pack_2 | >= 13.0.0.0 < publication | publication |
| microsoft | microsoft_sharepoint_server_2019 | >= 16.0.0 < publication | publication |
| microsoft | sharepoint_enterprise_server | — | — |
| microsoft | sharepoint_foundation | — | — |
| microsoft | sharepoint_server | — | — |
| mozilla | firefox | — | — |
| mozilla | thunderbird | >= 0 < 1:68.7.0+build1-0ubuntu0.16.04.2 | 1:68.7.0+build1-0ubuntu0.16.04.2 |
| msrc | microsoft_sharepoint_enterprise_server_2013_service_pack_1 | — | — |
| msrc | microsoft_sharepoint_enterprise_server_2016 | — | — |
| msrc | microsoft_sharepoint_server_2010_service_pack_2 | — | — |
| msrc | microsoft_sharepoint_server_2019 | — | — |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
osv8.8HIGH
vendor_msrc8.0HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-6m9m-j2hw-pppg: Microsoft SharePoint Spoofing Vulnerability This CVE ID is unique from CVE-2020-17016, CVE-2020-17060
ghsa_unreviewed·2022-05-24·CVSS 8.0
CVE-2020-17015 [HIGH] CWE-20 GHSA-6m9m-j2hw-pppg: Microsoft SharePoint Spoofing Vulnerability This CVE ID is unique from CVE-2020-17016, CVE-2020-17060
Microsoft SharePoint Spoofing Vulnerability This CVE ID is unique from CVE-2020-17016, CVE-2020-17060.
GHSA
GHSA-r2cr-p8cx-757w: Microsoft SharePoint Spoofing Vulnerability This CVE ID is unique from CVE-2020-17015, CVE-2020-17016
ghsa_unreviewed·2022-05-24·CVSS 4.3
CVE-2020-17060 [MEDIUM] CWE-20 GHSA-r2cr-p8cx-757w: Microsoft SharePoint Spoofing Vulnerability This CVE ID is unique from CVE-2020-17015, CVE-2020-17016
Microsoft SharePoint Spoofing Vulnerability This CVE ID is unique from CVE-2020-17015, CVE-2020-17016.
GHSA
GHSA-2wcf-8w35-jp7x: Microsoft SharePoint Spoofing Vulnerability This CVE ID is unique from CVE-2020-17015, CVE-2020-17060
ghsa_unreviewed·2022-05-24·CVSS 4.3
CVE-2020-17016 [MEDIUM] CWE-20 GHSA-2wcf-8w35-jp7x: Microsoft SharePoint Spoofing Vulnerability This CVE ID is unique from CVE-2020-17015, CVE-2020-17060
Microsoft SharePoint Spoofing Vulnerability This CVE ID is unique from CVE-2020-17015, CVE-2020-17060.
OSV
thunderbird vulnerabilities
osv·2020-04-21·CVSS 8.8
CVE-2019-11757 thunderbird vulnerabilities
thunderbird vulnerabilities
Multiple security issues were discovered in Thunderbird. If a user were
tricked in to opening a specially crafted website in a browsing context,
an attacker could potentially exploit these to cause a denial of service,
obtain sensitive information, bypass security restrictions, bypass
same-origin restrictions, conduct cross-site scripting (XSS) attacks, or
execute arbitrary code. (CVE-2019-11757, CVE-2019-11758, CVE-2019-11759,
CVE-2019-11760, CVE-2019-11761, CVE-2019-11762, CVE-2019-11763,
CVE-2019-11764, CVE-2019-17005, CVE-2019-17008, CVE-2019-17010,
CVE-2019-17011, CVE-2019-17012, CVE-2019-17016, CVE-2019-17017,
CVE-2019-17022, CVE-2019-17024, CVE-2019-17026, CVE-2019-20503,
CVE-2020-6798, CVE-2020-6800, CVE-2020-6805, CVE-2020-6806, CVE-2020-6807,
CVE-2020
Microsoft
Microsoft SharePoint Server Spoofing Vulnerability
vendor_msrc·2020-11-10·CVSS 8.0
CVE-2020-17016 [HIGH] Microsoft SharePoint Server Spoofing Vulnerability
Microsoft SharePoint Server Spoofing Vulnerability
Microsoft Office SharePoint: Microsoft Office SharePoint
Microsoft: Microsoft
Customer Action Required: Yes
Impact: Spoofing
Exploit Status: Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely;Older Software Release:Exploitation Less Likely;DOS:N/A
Reference: https://www.microsoft.com/download/details.aspx?familyid=9a9c9608-da2b-47c6-90f6-20ef0bf01896
Reference: https://support.microsoft.com/help/4486717
Reference: https://www.microsoft.com/download/details.aspx?familyid=6b9991e7-3dfd-42e2-80a5-1cb22827b2da
Reference: https://www.microsoft.com/download/details.aspx?familyid=466c8e2f-7b95-4a9a-94a7-17ee57f8d01e
Reference: https://support.microsoft.com/help/4486714
Reference: https://www.microsoft.c
Mozilla
Mozilla Foundation Security Advisory 2020-02: CVE-2019-17016
vendor_mozilla·CVSS 6.1
CVE-2019-17016 [MEDIUM] Mozilla Foundation Security Advisory 2020-02: CVE-2019-17016
Mozilla Foundation Security Advisory 2020-02
CVE: CVE-2019-17016
Product: Firefox ESR
Impact: high
Fixed in: Firefox ESR 68.4
Mozilla
Mozilla Foundation Security Advisory 2020-04: CVE-2019-17016
vendor_mozilla·CVSS 6.1
CVE-2019-17016 [MEDIUM] Mozilla Foundation Security Advisory 2020-04: CVE-2019-17016
Mozilla Foundation Security Advisory 2020-04
CVE: CVE-2019-17016
Product: Thunderbird
Impact: high
Fixed in: Thunderbird 68.4.1
Mozilla
Mozilla Foundation Security Advisory 2020-01: CVE-2019-17016
vendor_mozilla·CVSS 6.1
CVE-2019-17016 [MEDIUM] Mozilla Foundation Security Advisory 2020-01: CVE-2019-17016
Mozilla Foundation Security Advisory 2020-01
CVE: CVE-2019-17016
Product: Firefox
Impact: high
Fixed in: Firefox 72
No detection rules found.
No public exploits indexed.
Qualys
November 2020 Patch Tuesday – 112 Vulnerabilities, 17 Critical, Windows Codecs, Network File System, Workstation, Adobe | Qualys
blogs_qualys·2020-11-10·CVSS 5.3
[MEDIUM] November 2020 Patch Tuesday – 112 Vulnerabilities, 17 Critical, Windows Codecs, Network File System, Workstation, Adobe | Qualys
This month’s Microsoft Patch Tuesday addresses 112 vulnerabilities with 17 of them labeled as Critical. The 17 Critical vulnerabilities cover Windows Codecs, Network File System, Sharepoint, Windows Print Spooler, and several other workstation vulnerabilities. Adobe released patches today for Adobe Connect and Adobe Reader for Android.
### Workstation Patches
The Windows Codecs, GDI+, Browser, Office and Exchange Server vulnerabilities should be prioritized for workstation-type devices, meaning any system that is used for email or to access the internet via a browser. This includes multi-user servers that are used as remote desktops for users.
### SharePoint RCE
Microsoft patched six vulnerabilities in SharePoint, and one of them could lead to Remote Code Execution (CVE-2020-17061). Th
Qualys
November 2020 Patch Tuesday – 112 Vulnerabilities, 17 Critical, Windows Codecs, Network File System, Workstation, Adobe
blogs_qualys·2020-11-10·CVSS 5.3
[MEDIUM] November 2020 Patch Tuesday – 112 Vulnerabilities, 17 Critical, Windows Codecs, Network File System, Workstation, Adobe
This month’s Microsoft Patch Tuesday addresses 112 vulnerabilities with 17 of them labeled as Critical. The 17 Critical vulnerabilities cover Windows Codecs, Network File System, Sharepoint, Windows Print Spooler, and several other workstation vulnerabilities. Adobe released patches today for Adobe Connect and Adobe Reader for Android.
## Workstation Patches
The Windows Codecs, GDI+, Browser, Office and Exchange Server vulnerabilities should be prioritized for workstation-type devices, meaning any system that is used for email or to access the internet via a browser. This includes multi-user servers that are used as remote desktops for users.
## SharePoint RCE
Microsoft patched six vulnerabilities in SharePoint, and one of them could lead to Remote Code Execution ( CVE-2020-17061 ). Th
Bugzilla
CVE-2019-17016 Mozilla: Bypass of @namespace CSS sanitization during pasting
bugzilla·2020-01-07·CVSS 6.1
CVE-2019-17016 [MEDIUM] CVE-2019-17016 Mozilla: Bypass of @namespace CSS sanitization during pasting
CVE-2019-17016 Mozilla: Bypass of @namespace CSS sanitization during pasting
When pasting a `` tag from the clipboard into a rich text editor, the CSS sanitizer incorrectly rewrites a @namespace rule. This could allow for injection into certain types of websites resulting in data exfiltration.
External Reference:
https://www.mozilla.org/en-US/security/advisories/mfsa2020-02/#CVE-2019-17016
Discussion:
Acknowledgments:
Name: the Mozilla project
Upstream: Michał Bentkowski
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 6
Via RHSA-2020:0086 https://access.redhat.com/errata/RHSA-2020:0086
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 7
Via RHSA-2020:0085 https://access.redhat.com/errata/RHSA-2020:0085
2020-11-11
Published