Summary
Impact: Security Feature Bypass. Microsoft rating: Critical. Not known to be exploited — Exploitation More Likely. Customer action: Required.
Details
Are any additional steps required to protect my SharePoint farm after installing the January 10, 2023 security update for SharePoint Server?
Yes. Customers must also trigger a SharePoint upgrade action included in this update to protect their SharePoint farm. The upgrade action can be triggered by running the SharePoint Products Configuration Wizard, the Upgrade-SPFarm PowerShell cmdlet, or the "psconfig.exe -cmd upgrade -inplace b2b" command on each SharePoint server after installing the update.
How could an attacker exploit this vulnerability?
In a network-based attack, an unauthenticated attacker could bypass authentication and make an anonymous connection.
What kind of security feature could be bypassed by successfully exploiting this vulnerability?
An unauthenticated attacker is able to bypass the expected user access.
Security updates
16.0.5378.1000 — https://support.microsoft.com/help/5002338
16.0.10394.20021 — https://support.microsoft.com/help/5002329
16.0.15601.20418 — https://support.microsoft.com/help/5002331
Vulnerabilities 1
-
Medium 5.3
Microsoft SharePoint Server Security Feature Bypass Vulnerability
Microsoft SharePoint Server Security Feature Bypass Vulnerability
Revision history
-
#1
Information published.
References
-
CVE-2023-21743 Microsoft SharePoint Server Security Feature Bypass Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21743
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss