Main Vulnerability Database Vulnerabilities #VU70958

Input validation error in Microsoft products - CVE-2023-21742

Published: January 10, 2023 / Updated: December 19, 2024

Vulnerability identifier: #VU70958

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-21742

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: Public exploit is available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the system.

The vulnerability exists due to insufficient validation of user-supplied input in Microsoft SharePoint Server. A remote user can pass specially crafted input to the application and execute arbitrary code on the target system.

Affected software

Microsoft SharePoint Server Subscription Edition
Microsoft SharePoint Foundation
Microsoft SharePoint Enterprise Server
Microsoft SharePoint Server

How to mitigate CVE-2023-21742

Install updates from vendor's website.

Links to Public Exploits and PoC-codes

Exploit #11006 - CVE-2023-21742 (CVE-2023-21742 Poc) (December 19, 2024)

External References

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-21742

Related Security Bulletins

Multiple vulnerabilities in Microsoft SharePoint Server