MSRC-CVE-2022-29108 — Microsoft SharePoint Server Remote Code Execution Vulnerability

Summary

Impact: Remote Code Execution. Microsoft rating: Important. Not known to be exploited — Exploitation More Likely. Customer action: Required.

Details

According to the CVSS metric, privileges required is low (PR:L). What does that mean for this vulnerability?
The attacker must be authenticated and possess the permissions for page creation to be able to exploit this vulnerability.

Security updates
16.0.5317.1000 — https://support.microsoft.com/kb/5002195
16.0.10386.20011 — https://support.microsoft.com/kb/5002207
16.0.14931.20286 — https://support.microsoft.com/kb/5002194
15.0.5449.1000 — https://support.microsoft.com/kb/5002203

Vulnerabilities 1

High 8.8

CVE-2022-29108 EPSS 11%

Microsoft SharePoint Server Remote Code Execution Vulnerability

Microsoft SharePoint Server Remote Code Execution Vulnerability

Microsoft Microsoft SharePoint Server 2019 Microsoft SharePoint Enterprise Server 2016 Microsoft SharePoint Server Subscription Edition

May 10, 2022

Revision history

2022-05-10 #1
Information published.

References

CVE-2022-29108 Microsoft SharePoint Server Remote Code Execution Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-29108
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
Common Vulnerability Scoring System
https://www.first.org/cvss