SB2022061461 - Multiple vulnerabilities in Microsoft SharePoint Server

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Input validation error (CVE-ID: CVE-2022-30158)

The vulnerability allows a remote attacker to execute arbitrary code on the system.

The vulnerability exists due to insufficient validation of user-supplied input in Microsoft SharePoint Server. A remote user can pass specially crafted input to the application and execute arbitrary code on the target system.

2) Deserialization of Untrusted Data (CVE-ID: CVE-2022-30157)

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to insecure input validation when processing serialized charts data. A remote user can pass specially crafted data to the application and execute arbitrary code in the context of the SharePoint web server process.

Remediation

Install update from vendor's website.

References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-30158
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-30157
• https://www.zerodayinitiative.com/advisories/ZDI-22-871/