Multiple vulnerabilities in Microsoft SharePoint Server
| Risk | Medium |
| Patch available | YES |
| Number of vulnerabilities | 3 |
| CVE-ID | CVE-2023-24955 CVE-2023-24950 CVE-2023-24954 |
| CWE-ID | CWE-94 CWE-451 CWE-200 |
| Exploitation vector | Network |
| Public exploit | Vulnerability #1 is being exploited in the wild. |
| Vulnerable software Subscribe |
Microsoft SharePoint Server Server applications / Application servers Microsoft SharePoint Server Subscription Edition Server applications / Application servers Microsoft SharePoint Enterprise Server Server applications / Application servers |
| Vendor | Microsoft |
Security Bulletin
This security bulletin contains information about 3 vulnerabilities.
1) Code Injection
EUVDB-ID: #VU75907
Risk: High
CVSSv3.1: 8.4 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C]
CVE-ID: CVE-2023-24955
CWE-ID:
CWE-94 - Improper Control of Generation of Code ('Code Injection')
Exploit availability: Yes
DescriptionThe vulnerability allows a remote user to execute arbitrary code on the target system.
The vulnerability exists due to improper input validation within the GenerateProxyAssembly method. A remote privileged user can send a specially crafted request and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsMicrosoft SharePoint Server: 2019
Microsoft SharePoint Server Subscription Edition: All versions
Microsoft SharePoint Enterprise Server: 2016
External linkshttp://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2023-24955
http://www.zerodayinitiative.com/advisories/ZDI-23-883/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
Is there known malware, which exploits this vulnerability?
Yes. This vulnerability is being exploited in the wild.
2) Spoofing attack
EUVDB-ID: #VU75909
Risk: Medium
CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2023-24950
CWE-ID:
CWE-451 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to incorrect processing of user-supplied within the implementation of the AdRotator WebControl. A remote user can perform NTLM relay attack and obtain credentials of the service account.
Install updates from vendor's website.
Vulnerable software versionsMicrosoft SharePoint Server: 2019
Microsoft SharePoint Server Subscription Edition: All versions
Microsoft SharePoint Enterprise Server: 2016
External linkshttp://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2023-24950
http://www.zerodayinitiative.com/advisories/ZDI-23-571/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
3) Information disclosure
EUVDB-ID: #VU75908
Risk: Medium
CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2023-24954
CWE-ID:
CWE-200 - Information exposure
Exploit availability: No
DescriptionThe vulnerability allows a remote user to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output within the userphoto endpoint. A remote user can gain unauthorized access to sensitive information on the system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsMicrosoft SharePoint Server: 2019
Microsoft SharePoint Server Subscription Edition: All versions
Microsoft SharePoint Enterprise Server: 2016
External linkshttp://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2023-24954
http://www.zerodayinitiative.com/advisories/ZDI-23-884/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
