According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?

Successful exploitation of this vulnerability requires an attacker to win a race condition.

What privileges could an attacker gain?

An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.

Information published.

According to the CVSS metric, the attack vector is local (AV:L). Why does the CVE title indicate that this is a remote code execution?

The word Remote in the title refers to the location of the attacker. This type of exploit is sometimes referred to as Arbitrary Code Execution (ACE). The attack itself is carried out locally.

For example, when the score indicates that the Attack Vector is Local and User Interaction is Required, this could describe an exploit in which an attacker, through social engineering, convinces a victim to download and open a specially crafted file from a website which leads to a local attack on their computer.

Information published.

According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?

Exploitation of the vulnerability requires that a user to log in to Windows.

What type of privileges could an attacker gain through this vulnerability?

An attacker who successfully exploited the vulnerability could gain remote interactive logon rights to a machine where the victim's account would not normally hold such privilege.

Information published.

How could an attacker exploit this vulnerability?

An unauthenticated attacker could exploit the vulnerability by sending specially crafted network traffic to the TLS server and could cause it to crash.

The CVSS Metric for Confidentiality is Low (C:L). What type of information could be disclosed by this vulnerability?

An attacker who successfully exploited this vulnerability might be able to disclose a single byte of kernel memory. While this is technically information disclosure, the loss is very low.

Information published.

How could an attacker exploit this vulnerability?

An unauthenticated attacker could perform a man-in-the-middle network exploit to downgrade a client's encryption to the RC4-md4 cypher, followed by cracking the user's cypher key. The attacker could then compromise the user's Kerberos session key to elevate privileges.

According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?

The attacker must inject themselves into the logical network path between the target and the resource requested by the victim to read or modify network communications. This is called a man-in-the-middle (MITM) attack.

What privileges could an attacker gain?

An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.

Are default configurations of Kerberos impacted by this vulnerability?

No. For this vulnerability to be exploitable, the victim user must have the Do not require Kerberos preauthentication option enabled and must have a configured RC4 key. This option is not enabled by default.

Information published.

What privileges could an attacker gain?

An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.

Information published.

How could an attacker exploit this vulnerability?

An authenticated user could run a specially crafted trusted solution package to execute arbitrary SQL commands. From there the attacker could escalate and execute commands as db_owner within their Dynamics 365 database.

According to the CVSS metric, privileges required is low (PR:L). What does that mean for this vulnerability?

The user must be authenticated to be able to exploit this vulnerability.

Information published.

According to the CVSS metric, privileges required is low (PR:L). What does that mean for this vulnerability?

The attacker must be authenticated and possess the permissions for page creation to be able to exploit this vulnerability.

I am running SharePoint Enterprise Server 2013 Service Pack 1. Do I need to install both updates that are listed for SharePoint Enterprise Server 2013 Service Pack 1?

No. The Cumulative update for SharePoint Server 2013 includes the update for Foundation Server 2013. Customers running SharePoint Server 2013 Service Pack 1 can install the cumulative update or the security update, which is the same update as for Foundation Server 2013.

Please note that this is a clarification of the existing servicing model for SharePoint Server 2013 and applies for all previous updates.

How could an attacker exploit this vulnerability?

In a network-based attack an attacker would need to have the privileges to create a page on a vulnerable SharePoint server. By creating a site using specific code, the attacker could execute code remotely on the target server.

Information published.

What privileges could an attacker gain?

An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.

Information published.

According to the CVSS metric, privileges required is low (PR:L). What does that mean for this vulnerability?

The attacker must be authenticated to the target site, with the permission to use Manage Lists within SharePoint.

How could an attacker exploit the vulnerability?

In a network-based attack, an authenticated attacker with Manage List permissions could execute code remotely on the SharePoint Server.

I am running SharePoint Enterprise Server 2013 Service Pack 1. There are multiple updates listed in the Security Updates table. Do I need to install all of these updates?

No. The Cumulative update for SharePoint Enterprise Server 2013 (uberserv2013) includes the update for Foundation Server 2013. Customers running SharePoint Enterprise Server 2013 Service Pack 1 can install the cumulative update or the security update (sts2013), which is the same update as for Foundation Server 2013.

Customers running SharePoint Enterprise Server 2013 Service Pack 1 should also install the wssloc update as it contains language pack updates.

Please note that this is a clarification of the existing servicing model for SharePoint Server 2013 and applies for all previous updates.

I am running SharePoint Foundation Server 2013, SharePoint Enterprise Server 2016, or SharePoint Server 2019. There are multiple updates available for each of these affected versions. Do I need to install all the updates listed in the Security Updates table for these versions?

Yes. Customers should apply all updates offered for the software installed on their systems. If multiple updates apply, they can be installed in any order.

Information published.

I am running SharePoint Enterprise Server 2013 Service Pack 1. Do I need to install both updates that are listed for SharePoint Enterprise Server 2013 Service Pack 1?

No. The Cumulative update for SharePoint Server 2013 includes the update for Foundation Server 2013. Customers running SharePoint Server 2013 Service Pack 1 can install the cumulative update or the security update, which is the same update as for Foundation Server 2013.

Please note that this is a clarification of the existing servicing model for SharePoint Server 2013 and applies for all previous updates.

According to the CVSS metric, privileges required is low (PR:L). What does that mean for this vulnerability?

The attacker must be authenticated to the target site, with the permission to use Manage Lists within SharePoint.

How could an attacker exploit the vulnerability?

In a network-based attack, an authenticated attacker with Manage List permissions could execute code remotely on the SharePoint Server.

Information published.

I am running SharePoint Enterprise Server 2013 Service Pack 1. Do I need to install both updates that are listed for SharePoint Enterprise Server 2013 Service Pack 1?

No. The Cumulative update for SharePoint Server 2013 includes the update for Foundation Server 2013. Customers running SharePoint Server 2013 Service Pack 1 can install the cumulative update or the security update, which is the same update as for Foundation Server 2013.

Please note that this is a clarification of the existing servicing model for SharePoint Server 2013 and applies for all previous updates.

According to the CVSS metric, privileges required is low (PR:L). What does that mean for this vulnerability?

The attacker must be authenticated to the target site, with the permission to use Manage Lists within SharePoint.

How could an attacker exploit the vulnerability?

In a network-based attack, an authenticated attacker with Manage List permissions could execute code remotely on the SharePoint Server.

Information published.

According to the CVSS metric, the attack vector is local (AV:L). Why does the CVE title indicate that this is a remote code execution?

The word Remote in the title refers to the location of the attacker. This type of exploit is sometimes referred to as Arbitrary Code Execution (ACE). The attack itself is carried out locally.

For example, when the score indicates that the Attack Vector is Local and User Interaction is Required, this could describe an exploit in which an attacker, through social engineering, convinces a victim to download and open a specially crafted file from a website which leads to a local attack on their computer.

According to the CVSS metric, a successful exploitation could lead to a scope change (S:C). What does this mean for this vulnerability?

This vulnerability could lead to a browser sandbox escape.

According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?

Successful exploitation of this vulnerability requires an attacker to take additional actions prior to exploitation to prepare the target environment.

What is the version information for this release?

Why is the severity for this CVE rated as Low, but the CVSS score is 7.7?

Per our severity guidelines, the amount of user interaction or preconditions required to allow this sort of exploitation downgraded the severity. The CVSS scoring system doesn't allow for this type of nuance.

Information published.

Information published.

Information published.

According to the CVSS metric, the attack vector is local (AV:L). Why does the CVE title indicate that this is a remote code execution?

The word Remote in the title refers to the location of the attacker. This type of exploit is sometimes referred to as Arbitrary Code Execution (ACE). The attack itself is carried out locally.

For example, when the score indicates that the Attack Vector is Local and User Interaction is Required, this could describe an exploit in which an attacker, through social engineering, convinces a victim to download and open a specially crafted file from a website which leads to a local attack on their computer.

Information published.

How could an attacker exploit this vulnerability?

An unauthenticated attacker could perform a man-in-the-middle network exploit to downgrade a client's encryption to the RC4-md4 cypher, followed by cracking the user's cypher key. The attacker could then compromise the user's Kerberos session key to elevate privileges.

According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?

The attacker must inject themselves into the logical network path between the target and the resource requested by the victim to read or modify network communications. This is called a man-in-the-middle (MITM) attack.

What privileges could an attacker gain?

An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.

Information published.

How could an attacker exploit this vulnerability?

An authenticated user could run a specially crafted trusted solution package to execute arbitrary SQL commands. From there the attacker could escalate and execute commands as db_owner within their Dynamics 365 database.

According to the CVSS metric, privileges required is low (PR:L). What does that mean for this vulnerability?

The user must be authenticated to be able to exploit this vulnerability.

Information published.

According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?