Summary
Impact: Remote Code Execution. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.
Details
According to the CVSS metric, privileges required is low (PR:L). What does that mean for this vulnerability?
The attacker must be authenticated to the target site, with the permission to use Manage Lists within SharePoint.
How could an attacker exploit the vulnerability?
In a network-based attack, an authenticated attacker with Manage List permissions could execute code remotely on the SharePoint Server.
I am running SharePoint Enterprise Server 2013 Service Pack 1. There are multiple updates listed in the Security Updates table. Do I need to install all of these updates?
No. The Cumulative update for SharePoint Enterprise Server 2013 (uberserv2013) includes the update for Foundation Server 2013. Customers running SharePoint Enterprise Server 2013 Service Pack 1 can install the cumulative update or the security update (sts2013), which is the same update as for Foundation Server 2013.
Customers running SharePoint Enterprise Server 2013 Service Pack 1 should also install the wssloc update as it contains language pack updates.
Please note that this is a clarification of the existing servicing model for SharePoint Server 2013 and applies for all previous updates.
I am running SharePoint Foundation Server 2013, SharePoint Enterprise Server 2016, or SharePoint Server 2019. There are multiple updates available for each of these affected versions. Do I need to install all the updates listed in the Security Updates table for these versions?
Yes. Customers should apply all updates offered for the software installed on their systems. If multiple updates apply, they can be installed in any order.
Security updates
16.0.5361.1002 — https://support.microsoft.com/kb/5002269
16.0.5361.1000 — https://support.microsoft.com/kb/5002142
15.0.5485.1000 — https://support.microsoft.com/kb/5002264
15.0.5485.1000 — https://support.microsoft.com/kb/5002267
15.0.5485.1000 — https://support.microsoft.com/kb/5002159
16.0.10390.20000 — https://support.microsoft.com/kb/5002258
16.0.10390.20000 — https://support.microsoft.com/kb/5002257
16.0.15601.20052 — https://support.microsoft.com/kb/5002271
16.0.15601.20052 — https://support.microsoft.com/kb/5002270
Vulnerabilities 1
-
High 8.8
Microsoft SharePoint Server Remote Code Execution Vulnerability
Microsoft SharePoint Server Remote Code Execution Vulnerability
Revision history
-
#1
Information published.
References
-
CVE-2022-38008 Microsoft SharePoint Server Remote Code Execution Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-38008
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss