Multiple vulnerabilities in Microsoft SharePoint Server

Published: 2022-12-13

Risk	Medium
Patch available	YES
Number of vulnerabilities	2
CVE-ID	CVE-2022-44690 CVE-2022-44693
CWE-ID	CWE-20
Exploitation vector	Network
Public exploit	N/A
Vulnerable software Subscribe	Microsoft SharePoint Server Subscription Edition Server applications / Application servers Microsoft SharePoint Foundation Server applications / Application servers Microsoft SharePoint Enterprise Server Server applications / Application servers
Vendor	Microsoft

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Input validation error

EUVDB-ID: #VU70218

Risk: Medium

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-44690

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the system.

The vulnerability exists due to insufficient validation of user-supplied input in the Microsoft SharePoint Server. A remote user can pass specially crafted input to the application and execute arbitrary code on the target system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Microsoft SharePoint Server Subscription Edition: All versions

Microsoft SharePoint Foundation: 2013 Service Pack 1

Microsoft SharePoint Enterprise Server: 2013 Service Pack 1 - 2016

External links

http://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-44690

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Input validation error

EUVDB-ID: #VU70219