May 2023: Microsoft SharePoint Server Remote Code Execution Vulnerability
CVE-2023-24955 Published on May 9, 2023
Microsoft SharePoint Server Remote Code Execution Vulnerability
Microsoft SharePoint Server Remote Code Execution Vulnerability
Known Exploited Vulnerability
This Microsoft SharePoint Server Code Injection Vulnerability is part of CISA's list of Known Exploited Vulnerabilities. Microsoft SharePoint Server contains a code injection vulnerability that allows an authenticated attacker with Site Owner privileges to execute code remotely.
The following remediation steps are recommended / required by April 16, 2024: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Weakness Type
What is a Code Injection Vulnerability?
The software constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CVE-2023-24955 has been classified to as a Code Injection vulnerability or weakness.
Products Associated with CVE-2023-24955
Want to know whenever a new CVE is published for Microsoft Sharepoint Server? stack.watch will email you.
Affected Versions
Microsoft SharePoint Enterprise Server 2016:- Version 16.0.0 and below 16.0.5395.1000 is affected.
- Version 16.0.0 and below 16.0.10398.20000 is affected.
- Version 16.0.0 and below 16.0.16130.20420 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.