CVE-2020-16948 - An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly

CVE-2020-16948

Summary

An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user’s system. To exploit the vulnerability, an attacker would have to log on to an affected system and run a specially crafted application. The security update addresses the vulnerability by correcting how Microsoft SharePoint Server handles objects in memory.

References

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16948

Vulnerable Configurations

cpe:2.3:a:microsoft:sharepoint_foundation:2010:sp2:*:*:*:*:*:*
cpe:2.3:a:microsoft:sharepoint_foundation:2010:sp2:*:*:*:*:*:*
cpe:2.3:a:microsoft:sharepoint_foundation:2013:sp1:*:*:*:*:*:*
cpe:2.3:a:microsoft:sharepoint_foundation:2013:sp1:*:*:*:*:*:*
cpe:2.3:a:microsoft:sharepoint_enterprise_server:2016:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:sharepoint_enterprise_server:2016:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*

CVSS

Base:	4.0 (as of 31-12-2023 - 20:15)
Impact:
Exploitability:

CWE

NVD-CWE-noinfo

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	LOW	SINGLE

Impact

Confidentiality	Integrity	Availability
PARTIAL	NONE	NONE

cvss-vector via4

AV:N/AC:L/Au:S/C:P/I:N/A:N

refmap via4

misc

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16948

Last major update

31-12-2023 - 20:15

Published

16-10-2020 - 23:15

Last modified

31-12-2023 - 20:15