Attacker Value
Unknown
(0 users assessed)
Exploitability
Unknown
(0 users assessed)
User Interaction
None
Privileges Required
High
Attack Vector
Local
0

CVE-2020-16941

Disclosure Date: October 16, 2020
Add MITRE ATT&CK tactics and techniques that apply to this CVE.

Description

An information disclosure vulnerability exists when Microsoft SharePoint Server improperly discloses its folder structure when rendering specific web pages. An attacker who took advantage of this information disclosure could view the folder path of scripts loaded on the page.

To take advantage of the vulnerability, an attacker would require access to the specific SharePoint page affected by this vulnerability.

The security update addresses the vulnerability by correcting how scripts are referenced on some SharePoint pages.

Add Assessment

No one has assessed this topic. Be the first to add your voice to the community.

CVSS V3 Severity and Metrics
Base Score:
4.1 Medium
Impact Score:
3.6
Exploitability Score:
0.5
Vector:
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
Attack Vector (AV):
Local
Attack Complexity (AC):
High
Privileges Required (PR):
High
User Interaction (UI):
None
Scope (S):
Unchanged
Confidentiality (C):
High
Integrity (I):
None
Availability (A):
None

General Information

Vendors

  • microsoft

Products

  • sharepoint enterprise server 2016,
  • sharepoint foundation 2010,
  • sharepoint foundation 2013,
  • sharepoint server 2019

Additional Info

Technical Analysis