Code Injection in Microsoft products - CVE-2023-24955

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU75907

Code Injection in Microsoft products - CVE-2023-24955

Published: May 9, 2023 / Updated: March 26, 2024


Vulnerability identifier: #VU75907
CSH Severity: High
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-24955
CWE-ID: CWE-94
Exploitation vector: Remote access
Exploit availability: The vulnerability is being exploited in the wild

Vulnerability details

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation within the GenerateProxyAssembly method. A remote privileged user can send a specially crafted request and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


Affected software

Microsoft SharePoint Server Subscription Edition
Microsoft SharePoint Enterprise Server
Microsoft SharePoint Server

How to mitigate CVE-2023-24955

Install updates from vendor's website.


Links to Public Exploits and PoC-codes

External References

Related Security Bulletins