SB2023080881 - Multiple vulnerabilities in Microsoft SharePoint Server
Published: August 8, 2023
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 secuirty vulnerabilities.
1) Information disclosure (CVE-ID: CVE-2023-36890)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output by the application in Microsoft SharePoint Server. A remote user can gain unauthorized access to sensitive information on the system.
2) Information disclosure (CVE-ID: CVE-2023-36894)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output by the application in Microsoft SharePoint Server. A remote user can gain unauthorized access to sensitive information on the system.
3) Spoofing attack (CVE-ID: CVE-2023-36892)
The vulnerability allows a remote attacker to perform spoofing attack.
The vulnerability exists due to incorrect processing of user-supplied data in Microsoft SharePoint Server. A remote user can spoof page content.
4) Spoofing attack (CVE-ID: CVE-2023-36891)
The vulnerability allows a remote attacker to perform spoofing attack.
The vulnerability exists due to incorrect processing of user-supplied data in Microsoft SharePoint Server. A remote user can spoof page content.
Remediation
Install update from vendor's website.
References
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2023-36890
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2023-36894
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2023-36892
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2023-36891