Detections
Analytics
Microsoft SharePoint Server 2019 build < 16.0.10399.20005 Elevation of Privilege
critical Web App Scanning Plugin ID 114099
Language:
Synopsis
Microsoft SharePoint Server 2019 build < 16.0.10399.20005 Elevation of PrivilegeDescription
Microsoft SharePoint Server 2019 build < 16.0.10399.20005 is vulnerable to an Elevation of Privilege. An attacker who successfully exploited this vulnerability could gain administrator privileges.Solution
Upgrade to Microsoft SharePoint Server 2019 build 16.0.10399.20005 or later.See Also
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-29357
Plugin Details
Severity: Critical
ID: 114099
Type: remote
Family: Component Vulnerability
Published: 10/30/2023
Updated: 1/24/2024
Scan Template: basic, full, pci, scan
Risk Information
VPR
Risk Factor: High
Score: 8.9
CVSS v2
Risk Factor: Critical
Base Score: 10
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C
CVSS Score Source: CVE-2023-29357
CVSS v3
Risk Factor: Critical
Base Score: 9.8
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score Source: CVE-2023-29357
Vulnerability Information
CPE: cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 6/13/2023
Vulnerability Publication Date: 6/13/2023
CISA Known Exploited Vulnerability Due Dates: 1/31/2024
Reference Information
CVE: CVE-2023-29357
OWASP: 2010-A3, 2010-A8, 2013-A2, 2013-A7, 2013-A9, 2017-A2, 2017-A5, 2017-A9, 2021-A1, 2021-A6, 2021-A7
WASC: Insufficient Authentication, Insufficient Authorization
CAPEC: 114, 115, 151, 19, 194, 22, 441, 478, 479, 502, 503, 536, 546, 550, 551, 552, 556, 558, 562, 563, 564, 57, 578, 593, 633, 650, 94
DISA STIG: APSC-DV-000460, APSC-DV-002630
HIPAA: 164.306(a)(1), 164.306(a)(2), 164.312(a)(1), 164.312(a)(2)(i)
ISO: 27001-A.13.1.1, 27001-A.14.1.2, 27001-A.14.1.3, 27001-A.14.2.5, 27001-A.18.1.3, 27001-A.6.2.2, 27001-A.9.1.2, 27001-A.9.4.1, 27001-A.9.4.4, 27001-A.9.4.5
NIST: sp800_53-AC-3, sp800_53-CM-6b
OWASP API: 2019-API7, 2023-API8
OWASP ASVS: 4.0.2-1.4.2, 4.0.2-14.2.1
PCI-DSS: 3.2-6.2, 3.2-6.5.10, 3.2-6.5.8