Summary
Impact: Information Disclosure. Microsoft rating: Important. Not known to be exploited — Exploitation More Likely. Customer action: Required.
Details
What type of information could be disclosed by this vulnerability?
The type of information that could be disclosed if an attacker successfully exploited this vulnerability is user tokens and other potentially sensitive information.
According to the CVSS metric, successful exploitation of this vulnerability could lead to total loss of confidentiality (C:H)? What does that mean for this vulnerability?
A successful attacker could gain the Domain SID prefix for the targeted site.
According to the CVSS metric, privileges required is low (PR:L). What does that mean for this vulnerability?
The attacker must be authenticated to be able to exploit this vulnerability.
Security updates
16.0.5395.1000 — https://support.microsoft.com/help/5002397
16.0.10398.20000 — https://support.microsoft.com/help/5002389
16.0.16130.20420 — https://support.microsoft.com/help/5002390
Vulnerabilities 1
-
Medium 6.5
Microsoft SharePoint Server Information Disclosure Vulnerability
Microsoft SharePoint Server Information Disclosure Vulnerability
Revision history
-
#1
Information published.
References
-
CVE-2023-24954 Microsoft SharePoint Server Information Disclosure Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24954
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss