CVE-2018-8156 - An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka "Microsoft SharePoint Elevation of Privilege Vulnerability." This affects Microsoft SharePoint, Microsoft Project Server

Back Back to CVE browser

MEDIUM

An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka "Microsoft SharePoint Elevation of Privilege Vulnerability." This affects Microsoft SharePoint, Microsoft Project Server

Published May 9, 2018

5.4

MEDIUM

CVSS 3.0

EPSS 2.85%

Description

An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka "Microsoft SharePoint Elevation of Privilege Vulnerability." This affects Microsoft SharePoint, Microsoft Project Server. This CVE ID is unique from CVE-2018-8149, CVE-2018-8155, CVE-2018-8168.

Affected products

Vendor Microsoft Product Microsoft Project Server Default
n/a
- Version
  2010 Service Pack 2
  Status
  affected
  Constraints
  -
- Version
  2013 Service Pack 1
  Status
  affected
  Constraints
  -
Vendor Microsoft Product Microsoft SharePoint Default
n/a
- Version
  Enterprise Server 2016
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Microsoft

Microsoft Project Server

n/a

Version	Status	Constraints
2010 Service Pack 2	affected	-
2013 Service Pack 1	affected	-

Microsoft

Microsoft SharePoint

n/a

Version	Status	Constraints
Enterprise Server 2016	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (3)

http://www.securityfocus.com/bid/104048
vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1040856
vdb-entryx_refsource_SECTRACKThird Party AdvisoryVDB Entry
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8156
x_refsource_CONFIRMPatchVendor Advisory

Link	Providers	Tags
http://www.securityfocus.com/bid/104048		vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1040856		vdb-entryx_refsource_SECTRACKThird Party AdvisoryVDB Entry
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8156		x_refsource_CONFIRMPatchVendor Advisory