Lucene search

MicrosoftCVE-2018-0944

HistoryMar 14, 2018 - 5:29 p.m.

CVE-2018-0944

2018-03-1417:29:03

CWE-79

microsoft

web.nvd.nist.gov

cve-2018-0944

microsoft

project server 2013

sharepoint enterprise server 2016

privilege elevation

web requests

nvd

CVSS2

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.4

Confidence

High

EPSS

0.013

Percentile

86.1%

JSON

Microsoft Project Server 2013 SP1 and Microsoft SharePoint Enterprise Server 2016 allows an elevation of privilege vulnerability to due how specially crafted web requests are sanitized, aka “Microsoft SharePoint Elevation of Privilege Vulnerability”. This CVE is unique from CVE-2018-0909, CVE-2018-0910. CVE-2018-0911, CVE-2018-0912, CVE-2018-0913 CVE-2018-0914, CVE-2018-0915, CVE-2018-0916, CVE-2018-0917, CVE-2018-0921, CVE-2018-0923 and CVE-2018-0947.

Affected configurations

Nvd

Vulners

Node

microsoftproject_serverMatch2013sp1

microsoftsharepoint_enterprise_serverMatch2016

VendorProductVersionCPE
microsoftproject_server2013cpe:2.3:a:microsoft:project_server:2013:sp1:*:*:*:*:*:*
microsoftsharepoint_enterprise_server2016cpe:2.3:a:microsoft:sharepoint_enterprise_server:2016:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
microsoft	project_server	2013	cpe:2.3:a:microsoft:project_server:2013:sp1::::::
microsoft	sharepoint_enterprise_server	2016	cpe:2.3:a:microsoft:sharepoint_enterprise_server:2016:::::::*

CNA Affected

[
  {
    "product": "Microsoft SharePoint",
    "vendor": "Microsoft Corporation",
    "versions": [
      {
        "status": "affected",
        "version": "Microsoft Project Server 2013 SP1 and Microsoft SharePoint Enterprise Server 2016"
      }
    ]
  }
]