github - ghsa-hwjc-x258-8vxv

ghsa-hwjc-x258-8vxv

Vulnerability from github

Published

2022-05-24 16:53

Modified

2024-04-04 01:39

Severity ?

5.4 (Medium) - CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Details

Show details on source website

JSON

To clipboard

{
   affected: [],
   aliases: [
      "CVE-2019-1203",
   ],
   database_specific: {
      cwe_ids: [
         "CWE-79",
      ],
      github_reviewed: false,
      github_reviewed_at: null,
      nvd_published_at: "2019-08-14T21:15:00Z",
      severity: "MODERATE",
   },
   details: "A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'.",
   id: "GHSA-hwjc-x258-8vxv",
   modified: "2024-04-04T01:39:23Z",
   published: "2022-05-24T16:53:33Z",
   references: [
      {
         type: "ADVISORY",
         url: "https://nvd.nist.gov/vuln/detail/CVE-2019-1203",
      },
      {
         type: "WEB",
         url: "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1203",
      },
   ],
   schema_version: "1.4.0",
   severity: [
      {
         score: "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
         type: "CVSS_V3",
      },
   ],
}

CVE-2019-1203 (GCVE-0-2019-1203)

Vulnerability from cvelistv5

Published

2019-08-14 20:55

Modified

2024-08-04 18:13

Severity ?

Summary

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected SharePoint server. The attacker who successfully exploited the vulnerability could then perform cross-site scripting attacks on affected systems and run script in the security context of the current user. The attacks could allow the attacker to read content that the attacker is not authorized to read, use the victim's identity to take actions on the SharePoint site on behalf of the user, such as change permissions and delete content, and inject malicious content in the browser of the user. The security update addresses the vulnerability by helping to ensure that SharePoint Server properly sanitizes web requests.

References

▼	URL	Tags
	https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1203	x_refsource_MISC

Impacted products

Vendor

Product

Version

▼

Microsoft

Microsoft SharePoint Enterprise Server 2016

Version: 16.0.0 < publication
cpe:2.3:a:microsoft:sharepoint_server:2016:*:*:*:enterprise:*:*:*

	Microsoft	Microsoft SharePoint Enterprise Server 2013 Service Pack 1	Version: 15.0.0 < publication cpe:2.3:a:microsoft:sharepoint_server:2013:sp1:::enterprise:::*
	Microsoft	Microsoft SharePoint Server 2019	Version: 16.0.0 < publication cpe:2.3:a:microsoft:sharepoint_server:2019:::::::*

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T18:13:29.068Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1203",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               cpes: [
                  "cpe:2.3:a:microsoft:sharepoint_server:2016:*:*:*:enterprise:*:*:*",
               ],
               platforms: [
                  "x64-based Systems",
               ],
               product: "Microsoft SharePoint Enterprise Server 2016",
               vendor: "Microsoft",
               versions: [
                  {
                     lessThan: "publication",
                     status: "affected",
                     version: "16.0.0",
                     versionType: "custom",
                  },
               ],
            },
            {
               cpes: [
                  "cpe:2.3:a:microsoft:sharepoint_server:2013:sp1:*:*:enterprise:*:*:*",
               ],
               platforms: [
                  "x64-based Systems",
               ],
               product: "Microsoft SharePoint Enterprise Server 2013 Service Pack 1",
               vendor: "Microsoft",
               versions: [
                  {
                     lessThan: "publication",
                     status: "affected",
                     version: "15.0.0",
                     versionType: "custom",
                  },
               ],
            },
            {
               cpes: [
                  "cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*",
               ],
               platforms: [
                  "x64-based Systems",
               ],
               product: "Microsoft SharePoint Server 2019",
               vendor: "Microsoft",
               versions: [
                  {
                     lessThan: "publication",
                     status: "affected",
                     version: "16.0.0",
                     versionType: "custom",
                  },
               ],
            },
         ],
         datePublic: "2019-08-13T07:00:00+00:00",
         descriptions: [
            {
               lang: "en-US",
               value: "A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected SharePoint server.\nThe attacker who successfully exploited the vulnerability could then perform cross-site scripting attacks on affected systems and run script in the security context of the current user. The attacks could allow the attacker to read content that the attacker is not authorized to read, use the victim's identity to take actions on the SharePoint site on behalf of the user, such as change permissions and delete content, and inject malicious content in the browser of the user.\nThe security update addresses the vulnerability by helping to ensure that SharePoint Server properly sanitizes web requests.\n",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "Spoofing",
                     lang: "en-US",
                     type: "Impact",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-05-29T16:51:03.743Z",
            orgId: "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
            shortName: "microsoft",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1203",
            },
         ],
         title: "Microsoft Office SharePoint XSS Vulnerability",
      },
   },
   cveMetadata: {
      assignerOrgId: "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
      assignerShortName: "microsoft",
      cveId: "CVE-2019-1203",
      datePublished: "2019-08-14T20:55:05",
      dateReserved: "2018-11-26T00:00:00",
      dateUpdated: "2024-08-04T18:13:29.068Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted