CVE-2021-24072
published 2021-02-25CVE-2021-24072: Microsoft SharePoint Server Remote Code Execution Vulnerability
PriorityP356high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
2.25%
81.0th percentile
Microsoft SharePoint Server Remote Code Execution Vulnerability
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | microsoft_sharepoint_enterprise_server_2016 | >= 16.0.0 < publication | publication |
| microsoft | microsoft_sharepoint_foundation_2013_service_pack_1 | >= 15.0.0 < publication | publication |
| microsoft | microsoft_sharepoint_server_2019 | >= 16.0.0 < publication | publication |
| microsoft | sharepoint_enterprise_server | — | — |
| microsoft | sharepoint_foundation | — | — |
| microsoft | sharepoint_server | — | — |
| msrc | microsoft_sharepoint_enterprise_server_2016 | — | — |
| msrc | microsoft_sharepoint_foundation_2013_service_pack_1 | — | — |
| msrc | microsoft_sharepoint_server_2019 | — | — |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
vendor_msrc8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Microsoft
Microsoft SharePoint Server Remote Code Execution Vulnerability
vendor_msrc·2021-02-09·CVSS 8.8
CVE-2021-24072 [HIGH] Microsoft SharePoint Server Remote Code Execution Vulnerability
Microsoft SharePoint Server Remote Code Execution Vulnerability
Microsoft Office SharePoint: Microsoft Office SharePoint
Microsoft: Microsoft
Impact: Remote Code Execution
Exploit Status: Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation More Likely;Older Software Release:Exploitation More Likely;DOS:N/A
Reference: https://www.microsoft.com/download/details.aspx?familyid=fa1649de-dffb-4e32-9459-eb116767610b
Reference: https://support.microsoft.com/help/4493195
Reference: https://www.microsoft.com/download/details.aspx?familyid=8d1d0c3f-57e3-45a2-8045-c435d45c1e16
Reference: https://support.microsoft.com/help/4493194
Reference: https://www.microsoft.com/download/details.aspx?familyid=f407b400-72af-409b-a03c-d638ab6a0fe9
Reference: https://support.microsoft.co
GHSA
GHSA-hjp8-77wv-m44m: Microsoft SharePoint Server Remote Code Execution Vulnerability
ghsa_unreviewed·2022-05-24
CVE-2021-24072 [HIGH] GHSA-hjp8-77wv-m44m: Microsoft SharePoint Server Remote Code Execution Vulnerability
Microsoft SharePoint Server Remote Code Execution Vulnerability
No detection rules found.
No public exploits indexed.
Trendmicro
February Patch Tuesday Fixes 11 Critical Bugs
blogs_trendmicro·2021-02-10·CVSS 9.8
[CRITICAL] February Patch Tuesday Fixes 11 Critical Bugs
Exploits & Vulnerabilities
# February Patch Tuesday Fixes 11 Critical Bugs
Microsoft fixed 56 vulnerabilities - 11 of them rated Critical - in the February Patch Tuesday cycle.
By: Trend Micro
2021/02/10
Read time: ( words)
Save to Folio
February’s Patch Tuesday fixes a total of 56 vulnerabilities, with 11 of these being rated as Critical by Microsoft. This represents a decline both from January’s total of 83 vulnerabilities, as well as that of the same month in 2020, which had 99. Six of these vulnerabilities had been disclosed publicly, with a separate vulnerability being already exploited beforehand. Seven of these vulnerabilities were disclosed via the Zero Day Initiative (ZDI).
Fixed Critical Vulnerabilities: Networking components, Codecs
The nine Critical vulnerabilities are
Talos
Microsoft Patch Tuesday for Feb. 2021 — Snort rules and prominent vulnerabilities
blogs_talos·2021-02-09·CVSS 7.8
[HIGH] Microsoft Patch Tuesday for Feb. 2021 — Snort rules and prominent vulnerabilities
## Microsoft Patch Tuesday for Feb. 2021 — Snort rules and prominent vulnerabilities
By Jon Munshaw, with contributions from Bill Largent.
Microsoft released its monthly security update Tuesday, disclosing 56 vulnerabilities across its suite of products. This is the smallest amount of vulnerabilities Microsoft has disclosed in a month since January 2020.
There are only 11 critical vulnerabilities as part of this release, while there are three moderate-severity exploits, and the remainder are considered “important.” Users of all Microsoft and Windows products are urged to update their software as soon as possible to avoid possible exploitation of all these bugs.
The security updates cover several different products and services, including the Microsoft Office suite of products, the Wind
Talos
Microsoft Patch Tuesday for Feb. 2021 — Snort rules and prominent vulnerabilities
blogs_talos·2021-02-09·CVSS 7.8
[HIGH] Microsoft Patch Tuesday for Feb. 2021 — Snort rules and prominent vulnerabilities
By Jon Munshaw, with contributions from Bill Largent.
Microsoft released its monthly security update Tuesday, disclosing 56 vulnerabilities across its suite of products. This is the smallest amount of vulnerabilities Microsoft has disclosed in a month since January 2020.
There are only 11 critical vulnerabilities as part of this release, while there are three moderate-severity exploits, and the remainder are considered “important.” Users of all Microsoft and Windows products are urged to update their software as soon as possible to avoid possible exploitation of all these bugs.
The security updates cover several different products and services, including the Microsoft Office suite of products, the Windows DNS server and the SharePoint file-sharing service.
Talos also released a new set
Zscaler
Zscaler protects against 4 new vulnerabilities for MS-Window
blogs_zscaler·CVSS 7.8
[HIGH] Zscaler protects against 4 new vulnerabilities for MS-Window
Provide users with seamless, secure, reliable access to applications and data.
Build and run secure cloud apps, enable zero trust cloud connectivity, and protect workloads from data center to cloud.
Provide zero trust connectivity for IoT and OT devices and secure remote access to OT systems.
Provide zero trust site-to-site connectivity and reliable access to B2B apps for partners.
Industry Report
Zscaler: A Leader in the 2025 Gartner® Magic Quadrant™ for Security Service Edge (SSE)
USE CASES
INDUSTRY & MARKET SOLUTIONS
PARTNERS
TECHNOLOGY PARTNERS
Resource Center
Events & Trainings
Security Research & Services
Tools
Community & Support
CXO REVOLUTIONARIES
Amplifying the voices of real-world digital and zero trust pioneers
Discover how it began and where it’s going
Meet o
2021-02-25
Published