Main Vulnerability Database Vulnerabilities #VU80710

Permissions, Privileges, and Access Controls in Microsoft products - CVE-2023-36764

Published: September 13, 2023

Vulnerability identifier: #VU80710

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-36764

CWE-ID: CWE-264

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in Microsoft SharePoint Server, which leads to security restrictions bypass and privilege escalation.

Affected software

Microsoft SharePoint Enterprise Server
Microsoft SharePoint Server
Microsoft SharePoint Server Subscription Edition

How to mitigate CVE-2023-36764

Install updates from vendor's website.

Microsoft SharePoint Enterprise Server - update to 16.0.5413.1001
Microsoft SharePoint Server - update to 16.0.10402.20016
Microsoft SharePoint Server Subscription Edition - update to 16.0.16731.20180

External References

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2023-36764

Related Security Bulletins