CVE-2023-24955 | Attaxion

CISA Known Exploited Vulnerability (KEV)

Name

Microsoft SharePoint Server Code Injection Vulnerability

Exploit added

March 26, 2024

Action due

April 16, 2024

Action required

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Microsoft SharePoint Server Remote Code Execution Vulnerability

CWE-ID	CWE Name
CWE-94	Improper Control of Generation of Code (‘Code Injection’)

cpe:2.3:a:microsoft:sharepoint_server:-:language_pack:::subscription:::*
cpe:2.3:a:microsoft:sharepoint_server:-::::subscription:::
cpe:2.3:a:microsoft:sharepoint_enterprise_server:2016:::::::*
cpe:2.3:a:microsoft:sharepoint_server:2019:::::::*

Source:
NVD

Published:
May 9, 2023

Updated:
June 10, 2024

Base score:
7.2

Severity:

HIGH

Vector:
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Not defined