CVE-2022-38053
published 2022-10-11CVE-2022-38053: Microsoft SharePoint Server Remote Code Execution Vulnerability
PriorityP273high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
76.40%
99.5th percentile
Microsoft SharePoint Server Remote Code Execution Vulnerability
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | microsoft_sharepoint_enterprise_server_2013_service_pack_1 | >= 15.0.0 < 15.0.5493.1000 | 15.0.5493.1000 |
| microsoft | microsoft_sharepoint_enterprise_server_2016 | >= 16.0.0 < 16.0.5365.1000 | 16.0.5365.1000 |
| microsoft | microsoft_sharepoint_foundation_2013_service_pack_1 | >= 15.0.0 < 15.0.5493.1000 | 15.0.5493.1000 |
| microsoft | microsoft_sharepoint_server_2019 | >= 16.0.0 < 16.0.10391.20000 | 16.0.10391.20000 |
| microsoft | microsoft_sharepoint_server_subscription_edition | >= 16.0.0 < 16.0.15601.20158 | 16.0.15601.20158 |
| microsoft | sharepoint_enterprise_server | — | — |
| microsoft | sharepoint_enterprise_server | — | — |
| microsoft | sharepoint_foundation | — | — |
| microsoft | sharepoint_server | — | — |
| msrc | microsoft_sharepoint_enterprise_server_2013_service_pack_1 | — | — |
| msrc | microsoft_sharepoint_enterprise_server_2016 | — | — |
| msrc | microsoft_sharepoint_foundation_2013_service_pack_1 | — | — |
| msrc | microsoft_sharepoint_server_2019 | — | — |
| msrc | microsoft_sharepoint_server_subscription_edition | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Attacker must be authenticated with 'Manage Lists' permission on the target SharePoint site to exploit this RCE vulnerability ↗
- →Exploitation assessed as 'More Likely' for both latest and older software releases — prioritize detection and patching for all supported SharePoint Server versions ↗
- ·For SharePoint Enterprise Server 2013 SP1, only one update is needed — the Cumulative Update includes the Foundation Server 2013 update; do not double-apply ↗
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vendor_msrc8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-64qv-9rcm-pfxv: Microsoft SharePoint Server Remote Code Execution Vulnerability
ghsa_unreviewed·2022-10-12·CVSS 8.8
CVE-2022-41038 [HIGH] GHSA-64qv-9rcm-pfxv: Microsoft SharePoint Server Remote Code Execution Vulnerability
Microsoft SharePoint Server Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-38053, CVE-2022-41036, CVE-2022-41037.
GHSA
GHSA-gq3r-53wg-9xgg: Microsoft SharePoint Server Remote Code Execution Vulnerability
ghsa_unreviewed·2022-10-12·CVSS 8.8
CVE-2022-41037 [HIGH] GHSA-gq3r-53wg-9xgg: Microsoft SharePoint Server Remote Code Execution Vulnerability
Microsoft SharePoint Server Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-38053, CVE-2022-41036, CVE-2022-41038.
GHSA
GHSA-58rh-q4r8-94g3: Microsoft SharePoint Server Remote Code Execution Vulnerability
ghsa_unreviewed·2022-10-12·CVSS 8.8
CVE-2022-38053 [HIGH] GHSA-58rh-q4r8-94g3: Microsoft SharePoint Server Remote Code Execution Vulnerability
Microsoft SharePoint Server Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-41036, CVE-2022-41037, CVE-2022-41038.
GHSA
GHSA-25gc-rgw2-hc8g: Microsoft SharePoint Server Remote Code Execution Vulnerability
ghsa_unreviewed·2022-10-12·CVSS 8.8
CVE-2022-41036 [HIGH] GHSA-25gc-rgw2-hc8g: Microsoft SharePoint Server Remote Code Execution Vulnerability
Microsoft SharePoint Server Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-38053, CVE-2022-41037, CVE-2022-41038.
Microsoft
Microsoft SharePoint Server Remote Code Execution Vulnerability
vendor_msrc·2022-10-11·CVSS 8.8
CVE-2022-38053 [HIGH] Microsoft SharePoint Server Remote Code Execution Vulnerability
Microsoft SharePoint Server Remote Code Execution Vulnerability
FAQ: How could an attacker exploit the vulnerability?
In a network-based attack, an authenticated attacker with Manage List permissions could execute code remotely on the SharePoint Server.
FAQ: According to the CVSS metric, privileges required is low (PR:L). What does that mean for this vulnerability?
The attacker must be authenticated to the target site, with the permission to use Manage Lists within SharePoint.
FAQ: I am running SharePoint Enterprise Server 2013 Service Pack 1. Do I need to install both updates that are listed for SharePoint Enterprise Server 2013 Service Pack 1?
No. The Cumulative update for SharePoint Server 2013 includes the update for Foundation Server 2013. Customers running SharePoint Server 2013 S
No detection rules found.
No public exploits indexed.
2022-10-11
Published