Moderate
CVE-2020-1295 Microsoft SharePoint Elevation of Privilege Vulnerability
CVE ID
AttackerKB requires a CVE ID in order to pull vulnerability data and references from the CVE list and the National Vulnerability Database. If available, please supply below:
Add References:
Moderate
(1 user assessed)
Very Low
(1 user assessed)Unknown
Unknown
Unknown
CVE-2020-1295 Microsoft SharePoint Elevation of Privilege Vulnerability
MITRE ATT&CK
Collection
Command and Control
Credential Access
Defense Evasion
Discovery
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation
Topic Tags
Description
An elevation of privilege vulnerability exists in Microsoft SharePoint. An attacker who successfully exploited this vulnerability could attempt to impersonate another user of the SharePoint server.
To exploit this vulnerability, an authenticated attacker would send a specially crafted request to an affected server, thereby allowing the impersonation of another SharePoint user.
The security update addresses the vulnerability by correcting how Microsoft SharePoint sanitizes user input.
Add Assessment
Ratings
-
Attacker ValueMedium
-
ExploitabilityVery Low
Technical Analysis
Sure it’s an authenticated vuln, but being able to just switch user accounts sounds like a fun way to cause havoc, especially for long-term persistence type scenarios. Though I guess the average pentest is all about just getting the actual credentials in the first place, but this might be useful for real APT scenarios, especially since it affects the last three major releases.
Don’t know much details of the actual ‘specially crafted request’, so it’s hard to say exactly how exploitable this would be, and you do need creds in the first place. Probably nifty for insider jobs.
Would you also like to delete your Exploited in the Wild Report?
Delete Assessment Only Delete Assessment and Exploited in the Wild ReportGeneral Information
References
Additional Info
Technical Analysis
Report as Emergent Threat Response
Report as Exploited in the Wild
CVE ID
AttackerKB requires a CVE ID in order to pull vulnerability data and references from the CVE list and the National Vulnerability Database. If available, please supply below:
