CVE-2023-29357: critical vulnerability in Microsoft SharePoint Server 2019
Microsoft SharePoint Server Elevation of Privilege Vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Patch now. It under exploitation confirmed by CISA and has a working public exploit.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
A critical flaw in Microsoft SharePoint Server allows attackers to gain administrative privileges without proper authorization. An attacker with network access can exploit this vulnerability to take control of the SharePoint system and access sensitive data.
CWE-303 (improper authentication) vulnerability in SharePoint Server permits privilege escalation through network access without requiring valid credentials. An authenticated or unauthenticated attacker can bypass access controls to obtain administrative privileges, impacting confidentiality, integrity, and availability of the SharePoint environment.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.