CVE-2019-1443 - An information disclosure vulnerability exists in Microsoft SharePoint when an attacker uploads a specially crafted file to the SharePoint Server.An authenticated attacker who successfully exploited this vulnerability could potentially leverage SharePoint functionality to obtain SMB hashes.The security update addresses the vulnerability by correcting how SharePoint checks file content., aka 'Microsoft SharePoint Information Disclosure Vulnerability'

Back Back to CVE browser

MEDIUM

An information disclosure vulnerability exists in Microsoft SharePoint when an attacker uploads a specially crafted file to the SharePoint Server.An authenticated attacker who successfully exploited this vulnerability could potentially leverage SharePoint functionality to obtain SMB hashes.The security update addresses the vulnerability by correcting how SharePoint checks file content., aka 'Microsoft SharePoint Information Disclosure Vulnerability'

Published Nov 12, 2019

6.5

MEDIUM

CVSS 3.1

EPSS 5.75%

Description

An information disclosure vulnerability exists in Microsoft SharePoint when an attacker uploads a specially crafted file to the SharePoint Server.An authenticated attacker who successfully exploited this vulnerability could potentially leverage SharePoint functionality to obtain SMB hashes.The security update addresses the vulnerability by correcting how SharePoint checks file content., aka 'Microsoft SharePoint Information Disclosure Vulnerability'.

Affected products

Vendor Microsoft Product Microsoft SharePoint Enterprise Server Default
n/a
- Version
  2016
  Status
  affected
  Constraints
  -
Vendor Microsoft Product Microsoft SharePoint Foundation Default
n/a
- Version
  2010 Service Pack 2
  Status
  affected
  Constraints
  -
- Version
  2013 Service Pack 1
  Status
  affected
  Constraints
  -
Vendor Microsoft Product Microsoft SharePoint Server Default
n/a
- Version
  2019
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Microsoft

Microsoft SharePoint Enterprise Server

n/a

Version	Status	Constraints
2016	affected	-

Microsoft

Microsoft SharePoint Foundation

n/a

Version	Status	Constraints
2010 Service Pack 2	affected	-
2013 Service Pack 1	affected	-

Microsoft

Microsoft SharePoint Server

n/a

Version	Status	Constraints
2019	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-434

Unrestricted Upload of File

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-10000
Advisory
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1443
x_refsource_MISCPatchVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-10000		Advisory
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1443		x_refsource_MISCPatchVendor Advisory