CVE-2022-41062
published 2022-11-09CVE-2022-41062: Microsoft SharePoint Server Remote Code Execution Vulnerability
PriorityP355high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
1.51%
71.5th percentile
Microsoft SharePoint Server Remote Code Execution Vulnerability
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | microsoft_sharepoint_enterprise_server_2013_service_pack_1 | >= 15.0.0 < 15.0.5501.1000 | 15.0.5501.1000 |
| microsoft | microsoft_sharepoint_enterprise_server_2016 | >= 16.0.0 < 16.0.5369.1000 | 16.0.5369.1000 |
| microsoft | microsoft_sharepoint_foundation_2013_service_pack_1 | >= 15.0.0 < 15.0.5501.1000 | 15.0.5501.1000 |
| microsoft | microsoft_sharepoint_server_2019 | >= 16.0.0 < 16.0.10392.20000 | 16.0.10392.20000 |
| microsoft | microsoft_sharepoint_server_subscription_edition | >= 16.0.0 < 16.0.15601.20238 | 16.0.15601.20238 |
| microsoft | sharepoint_enterprise_server | — | — |
| microsoft | sharepoint_enterprise_server | — | — |
| microsoft | sharepoint_foundation | — | — |
| microsoft | sharepoint_server | — | — |
| msrc | microsoft_sharepoint_enterprise_server_2013_service_pack_1 | — | — |
| msrc | microsoft_sharepoint_enterprise_server_2016 | — | — |
| msrc | microsoft_sharepoint_foundation_2013_service_pack_1 | — | — |
| msrc | microsoft_sharepoint_server_2019 | — | — |
| msrc | microsoft_sharepoint_server_subscription_edition | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Attacker must be authenticated with at minimum Site Member permissions (PR:L) to exploit this RCE vulnerability on SharePoint Server ↗
- →Attack vector is network-based; monitor for authenticated low-privileged users executing unusual server-side code or processes on SharePoint Server ↗
- ·SharePoint Enterprise Server 2013 SP1 customers only need to install one update — the Cumulative Update for SharePoint Server 2013 already includes the Foundation Server 2013 security update ↗
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vendor_msrc8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-7gc8-x5gh-frxg: Microsoft SharePoint Server Remote Code Execution Vulnerability
ghsa_unreviewed·2022-11-10
CVE-2022-41062 [HIGH] GHSA-7gc8-x5gh-frxg: Microsoft SharePoint Server Remote Code Execution Vulnerability
Microsoft SharePoint Server Remote Code Execution Vulnerability.
Microsoft
Microsoft SharePoint Server Remote Code Execution Vulnerability
vendor_msrc·2022-11-08·CVSS 8.8
CVE-2022-41062 [HIGH] Microsoft SharePoint Server Remote Code Execution Vulnerability
Microsoft SharePoint Server Remote Code Execution Vulnerability
FAQ: I am running SharePoint Enterprise Server 2013 Service Pack 1. Do I need to install both updates that are listed for SharePoint Enterprise Server 2013 Service Pack 1?
No. The Cumulative update for SharePoint Server 2013 includes the update for Foundation Server 2013. Customers running SharePoint Server 2013 Service Pack 1 can install the cumulative update or the security update, which is the same update as for Foundation Server 2013.
Please note that this is a clarification of the existing servicing model for SharePoint Server 2013 and applies for all previous updates.
FAQ: According to the CVSS metric, privileges required is low (PR:L). What does that mean for this vulnerability?
The attacker must be authenticated to t
No detection rules found.
No public exploits indexed.
2022-11-09
Published