9.8

CVE-2023-29357

Warning

Microsoft SharePoint Server Elevation of Privilege Vulnerability

Data is provided by the National Vulnerability Database (NVD)
Microsoft ≫ Sharepoint Server Version2019

10.01.2024: CISA Known Exploited Vulnerabilities (KEV) Catalog

Microsoft SharePoint Server Privilege Escalation Vulnerability

Vulnerability

Microsoft SharePoint Server contains an unspecified vulnerability that allows an unauthenticated attacker, who has gained access to spoofed JWT authentication tokens, to use them for executing a network attack. This attack bypasses authentication, enabling the attacker to gain administrator privileges.

Description

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Required actions
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 94.36% 0.999
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
secure@microsoft.com 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-303 Incorrect Implementation of Authentication Algorithm

The requirements for the product dictate the use of an established authentication algorithm, but the implementation of the algorithm is incorrect.