An information disclosure vulnerability exists in SharePoint Server. An attacker who exploited this vulnerability could read arbitrary files on the server. To exploit the vulnerability, an attacker would need to send a specially crafted request to a susceptible SharePoint Server instance. The update addresses the vulnerability by changing how affected APIs process requests.

According to its self-reported version number, the Microsoft SharePoint application running on the remote host is affected by multiple vulnerabilities :

 - An information disclosure vulnerability exists in Microsoft SharePoint when an attacker uploads a specially crafted file to the SharePoint Server.

 - A security feature bypass vulnerability exists when Microsoft SharePoint does not validate URLs.

 - An information disclosure vulnerability exists when Microsoft SharePoint improperly discloses the contents of its memory.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The Microsoft SharePoint Server installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities :

  - A security feature bypass vulnerability exists when     Microsoft Office does not validate URLs. An attacker     could send a victim a specially crafted file, which     could trick the victim into entering credentials. An     attacker who successfully exploited this vulnerability     could perform a phishing attack. The update addresses     the vulnerability by ensuring Microsoft Office properly     validates URLs. (CVE-2019-1442)

  - An information disclosure vulnerability exists in     Microsoft SharePoint when an attacker uploads a     specially crafted file to the SharePoint Server. An     authenticated attacker who successfully exploited this     vulnerability could potentially leverage SharePoint     functionality to obtain SMB hashes. The security update     addresses the vulnerability by correcting how SharePoint     checks file content. (CVE-2019-1443)

  - An information disclosure vulnerability exists when     Microsoft Excel improperly discloses the contents of its     memory. An attacker who exploited the vulnerability     could use the information to compromise the users     computer or data.  (CVE-2019-1446)

  - An information disclosure vulnerability exists in     Microsoft SharePoint when an attacker sends a specially     crafted API request to the SharePoint Server. An     authenticated attacker who successfully exploited this     vulnerability could potentially read arbitrary files     on the server. The security update     addresses the vulnerability by changing how     affected APIs process requests. (CVE-2019-1491)

ID	Name	Product	Family	Severity
112327	Microsoft SharePoint Server 2013 build < 15.0.5189.1000 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
112326	Microsoft SharePoint Server 2019 build < 16.0.10352.20000 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
112325	Microsoft SharePoint Server 2016 build < 16.0.4927.1000 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
130914	Security Updates for Microsoft SharePoint Server (November 2019)	Nessus	Windows : Microsoft Bulletins	high

Detections

Analytics

CVE-2019-1491

high

Tenable Plugins

high

high

high

high