cbcvebase.
CVE-2024-21318
published 2024-01-09

CVE-2024-21318: Microsoft SharePoint Server Remote Code Execution Vulnerability

PriorityP270high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
30.80%
98.0th percentile
Microsoft SharePoint Server Remote Code Execution Vulnerability

Affected

8 ranges
VendorProductVersion rangeFixed in
microsoftmicrosoft_sharepoint_enterprise_server_2016>= 16.0.0 < 16.0.5430.100016.0.5430.1000
microsoftmicrosoft_sharepoint_server_2019>= 16.0.0 < 16.0.10406.2000016.0.10406.20000
microsoftmicrosoft_sharepoint_server_subscription_edition>= 16.0.0 < 16.0.10406.2000016.0.10406.20000
microsoftsharepoint_server
microsoftsharepoint_server
msrcmicrosoft_sharepoint_enterprise_server_2016
msrcmicrosoft_sharepoint_server_2019
msrcmicrosoft_sharepoint_server_subscription_edition

Detection & IOCsextracted from sources · hover to see the quote

snort
62847 – 62850 and 62854 – 62861
snort
300797 – 300802
  • Attacker must be authenticated with at least Site Owner permission on SharePoint Server to exploit this vulnerability via code injection.
  • Exploitation vector is network-based; monitor for authenticated SharePoint Site Owner accounts writing or injecting arbitrary code to SharePoint Server.
  • Microsoft rates this vulnerability as 'Exploitation More Likely' — prioritize detection and patching of SharePoint Server instances.
  • ·Snort rules 62847–62850, 62854–62861, and Snort 3 rules 300797–300802 cover multiple January 2024 Patch Tuesday vulnerabilities, not exclusively CVE-2024-21318. Validate rule applicability before relying solely on these for CVE-2024-21318 detection.
  • ·Additional Snort rules may be released at a future date and current rules are subject to change pending additional information.

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vendor_msrc8.8HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.