Main Vulnerability Database Vulnerabilities #VU21029

Input validation error in Microsoft SharePoint Foundation and Microsoft SharePoint Server - CVE-2019-1257

Published: September 11, 2019

Vulnerability identifier: #VU21029

CSH Severity: Medium

CVSS v4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-1257

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to insufficient validation of user-supplied input. A remote authenticated attacker with ability to upload a specially crafted SharePoint application package can execute arbitrary code on the system with privileges of the SharePoint server farm account.

Affected software

Microsoft SharePoint Foundation
Microsoft SharePoint Server

How to mitigate CVE-2019-1257

Install updates from vendor's website.

External References

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1257

Related Security Bulletins