cbcvebase.
CVE-2024-30044
published 2024-05-14

CVE-2024-30044: Microsoft SharePoint Server Remote Code Execution Vulnerability

PriorityP264high7.2CVSS 3.1
AVNACLPRHUINSUCHIHAH
EPSS
79.66%
99.6th percentile
Microsoft SharePoint Server Remote Code Execution Vulnerability

Affected

9 ranges
VendorProductVersion rangeFixed in
microsoftmicrosoft_sharepoint_enterprise_server_2016>= 16.0.0 < 16.0.5448.100016.0.5448.1000
microsoftmicrosoft_sharepoint_server_2019>= 16.0.0 < 16.0.10409.2004716.0.10409.20047
microsoftmicrosoft_sharepoint_server_subscription_edition>= 16.0.0 < 16.0.17328.2029216.0.17328.20292
microsoftsharepoint_server< 16.0.17328.2029216.0.17328.20292
microsoftsharepoint_server
microsoftsharepoint_server
msrcmicrosoft_sharepoint_enterprise_server_2016
msrcmicrosoft_sharepoint_server_2019
msrcmicrosoft_sharepoint_server_subscription_edition

Detection & IOCsextracted from sources · hover to see the quote

snort
63419, 63420, 63422 - 63432, 63444 and 63445
snort
300906 - 300912 (Snort 3)
  • Exploit requires an authenticated attacker with Site Owner permissions (or higher) to upload a specially crafted file to the targeted SharePoint Server, followed by crafted API requests to trigger deserialization of the file's parameters.
  • Microsoft rates exploitation as 'More Likely' despite no confirmed in-the-wild exploitation at time of disclosure; prioritize detection on internet-facing SharePoint Server instances.
  • ·Exploitation requires the attacker to already be authenticated with Site Owner privileges or higher — unauthenticated or low-privilege attackers cannot directly exploit this vulnerability.
  • ·The Talos Snort rules listed cover multiple May 2024 Patch Tuesday CVEs, not exclusively CVE-2024-30044; validate rule applicability before deployment.

CVSS provenance

nvdv3.17.2HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
vendor_msrc7.2HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.