cbcvebase.
CVE-2023-24950
published 2023-05-09

CVE-2023-24950: Microsoft SharePoint Server Spoofing Vulnerability

PriorityP352medium6.5CVSS 3.1
AVNACLPRLUINSUCHINAN
EPSS
67.45%
99.2th percentile
Microsoft SharePoint Server Spoofing Vulnerability

Affected

8 ranges
VendorProductVersion rangeFixed in
microsoftmicrosoft_sharepoint_enterprise_server_2016>= 16.0.0 < 16.0.5395.100016.0.5395.1000
microsoftmicrosoft_sharepoint_server_2019>= 16.0.0 < 16.0.10398.2000016.0.10398.20000
microsoftmicrosoft_sharepoint_server_subscription_edition>= 16.0.0 < 16.0.16130.2042016.0.16130.20420
microsoftsharepoint_enterprise_server
microsoftsharepoint_server
msrcmicrosoft_sharepoint_enterprise_server_2016
msrcmicrosoft_sharepoint_server_2019
msrcmicrosoft_sharepoint_server_subscription_edition

Detection & IOCsextracted from sources · hover to see the quote

  • An attacker with site-creation privileges on a vulnerable SharePoint server can trigger the server to leak its NTLM hash over the network — monitor for outbound NTLM authentication attempts (e.g., SMB/HTTP) originating from the SharePoint server to unexpected external or internal hosts.
  • ·Exploitation is rated 'More Likely' for the latest software release, though no public exploit or active exploitation has been confirmed at time of advisory publication.
  • ·Customer action (patching) is explicitly required; the vulnerability affects Microsoft SharePoint Server and requires the attacker to already have site-creation privileges, limiting the attack surface to authenticated users.

CVSS provenance

nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
vendor_msrc6.5MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.