cbcvebase.
CVE-2022-30158
published 2022-06-15

CVE-2022-30158: Microsoft SharePoint Server Remote Code Execution Vulnerability

PriorityP357high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
3.03%
86.0th percentile
Microsoft SharePoint Server Remote Code Execution Vulnerability

Affected

14 ranges
VendorProductVersion rangeFixed in
microsoftmicrosoft_sharepoint_enterprise_server_2016>= 16.0.0 < 16.0.5332.100116.0.5332.1001
microsoftmicrosoft_sharepoint_foundation_2013_service_pack_1>= 15.0.0 < 15.0.5459.100115.0.5459.1001
microsoftmicrosoft_sharepoint_server_2013_service_pack_1>= 15.0.0 < 15.0.5459.100115.0.5459.1001
microsoftmicrosoft_sharepoint_server_2019>= 16.0.0 < 16.0.10387.2000816.0.10387.20008
microsoftmicrosoft_sharepoint_server_subscription_edition>= 16.0.0 < 16.0.14931.2041816.0.14931.20418
microsoftsharepoint_foundation
microsoftsharepoint_server
microsoftsharepoint_server
microsoftsharepoint_server
msrcmicrosoft_sharepoint_enterprise_server_2016
msrcmicrosoft_sharepoint_foundation_2013_service_pack_1
msrcmicrosoft_sharepoint_server_2013_service_pack_1
msrcmicrosoft_sharepoint_server_2019
msrcmicrosoft_sharepoint_server_subscription_edition

Detection & IOCsextracted from sources · hover to see the quote

  • Attacker must be authenticated with page creation permissions to exploit this RCE vulnerability in SharePoint Server
  • Exploitation vector requires Sandboxed Code Service to be enabled on the target SharePoint server; monitor for abuse of this service by authenticated users
  • ·Vulnerability is only exploitable when the SharePoint Sandboxed Code Service is enabled; disabling this service reduces attack surface
  • ·For SharePoint Enterprise Server 2013 SP1, the Cumulative Update for SharePoint Server 2013 includes the Foundation Server 2013 update — only one update installation is required

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.0MEDIUMAV:N/AC:M/Au:S/C:P/I:P/A:P
vendor_msrc8.8HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.