CVE-2018-0909 — Microsoft Project Server 2013 SP1 and Microsoft SharePoint Enterprise Server 2016 allow an elevation of privilege vulnerability to due how specially crafted web requests are sanitized, aka "Microsoft SharePoint Elevation of Privilege Vulnerability"

Back Back to CVE browser

HIGH

Microsoft Project Server 2013 SP1 and Microsoft SharePoint Enterprise Server 2016 allow an elevation of privilege vulnerability to due how specially crafted web requests are sanitized, aka "Microsoft SharePoint Elevation of Privilege Vulnerability"

Published Mar 14, 2018

8.8

HIGH

CVSS 3.0

EPSS 4.53%

Description

Microsoft Project Server 2013 SP1 and Microsoft SharePoint Enterprise Server 2016 allow an elevation of privilege vulnerability to due how specially crafted web requests are sanitized, aka "Microsoft SharePoint Elevation of Privilege Vulnerability". This CVE is unique from CVE-2018-0910, CVE-2018-0911, CVE-2018-0912, CVE-2018-0913, CVE-2018-0914, CVE-2018-0915, CVE-2018-0916, CVE-2018-0917, CVE-2018-0921, CVE-2018-0923, CVE-2018-0944 and CVE-2018-0947.

Affected products

Vendor Microsoft Corporation Product Microsoft SharePoint Default
n/a
- Version
  Microsoft Project Server 2013 SP1 and Microsoft SharePoint Enterprise Server 2016
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Microsoft Corporation

Microsoft SharePoint

n/a

Version	Status	Constraints
Microsoft Project Server 2013 SP1 and Microsoft SharePoint Enterprise Server 2016	affected	-

Remediation

No remediation recorded yet.

Metrics

4.53% 0.04528

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.04528

Score over time

2021–2026

EPSS v1
EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v1
EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (24 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	4.53% (0.04528)	91.24th	v5 (v2026.06.15)
Jun 15, 2026	4.58% (0.04577)	90.38th	v5 (v2026.06.15)
Jun 4, 2026	10.95% (0.10954)	93.55th	v4 (v2025.03.14)
Aug 2, 2025	9.67% (0.09673)	92.63th	v4 (v2025.03.14)
Jul 6, 2025	7.38% (0.07376)	91.24th	v4 (v2025.03.14)
Mar 30, 2025	5.57% (0.05570)	89.34th	v4 (v2025.03.14)
Mar 29, 2025	18.11% (0.18114)	92.06th	v4 (v2025.03.14)
Mar 17, 2025	5.57% (0.05570)	89.60th	v4 (v2025.03.14)
Dec 12, 2024	1.34% (0.01337)	86.64th	v3 (v2023.03.01)
Jan 22, 2024	1.34% (0.01337)	84.64th	v3 (v2023.03.01)
Dec 28, 2023	1.65% (0.01646)	86.19th	v3 (v2023.03.01)
Nov 28, 2023	1.59% (0.01587)	85.91th	v3 (v2023.03.01)
Nov 1, 2023	1.32% (0.01321)	84.52th	v3 (v2023.03.01)
Oct 8, 2023	0.66% (0.00660)	77.21th	v3 (v2023.03.01)
Aug 26, 2023	0.49% (0.00494)	73.18th	v3 (v2023.03.01)
Aug 5, 2023	0.28% (0.00277)	64.01th	v3 (v2023.03.01)
Mar 7, 2023	0.31% (0.00312)	65.39th	v3 (v2023.03.01)
Mar 6, 2023	1.42% (0.01418)	73.14th	v2 (v2022.01.01)
Apr 1, 2022	1.42% (0.01418)	71.15th	v2 (v2022.01.01)
Feb 4, 2022	1.42% (0.01418)	50.43th	v2 (v2022.01.01)
Feb 3, 2022	9.25% (0.09255)	86.70th	v1
Jan 6, 2022	9.25% (0.09255)	86.54th	v1
Sep 1, 2021	9.25% (0.09255)	93.94th	v1
Apr 14, 2021	9.25% (0.09255)	0.00th	v1

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (3)

http://www.securityfocus.com/bid/103279
vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1040513
vdb-entryx_refsource_SECTRACKThird Party AdvisoryVDB Entry
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0909
x_refsource_CONFIRMPatchVendor Advisory

Link	Providers	Tags
http://www.securityfocus.com/bid/103279		vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1040513		vdb-entryx_refsource_SECTRACKThird Party AdvisoryVDB Entry
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0909		x_refsource_CONFIRMPatchVendor Advisory