CVE-2023-24954 : Microsoft SharePoint Server Information Disclosure Vulnerability

Microsoft SharePoint Server Information Disclosure Vulnerability

Published 2023-05-09 18:15:13

Updated 2024-05-29 02:15:25

Source Microsoft Corporation

View at NVD, CVE.org

Vulnerability category: Information leak

Products affected by CVE-2023-24954

Microsoft » Sharepoint Server » Version: 2019
cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*
Matching versions
Microsoft » Sharepoint Server » Version: N/A Subscription Edition
cpe:2.3:a:microsoft:sharepoint_server:-:*:*:*:subscription:*:*:*
Matching versions
Microsoft » Windows Server 2008 » Version: R2 Update SP1
cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*
Matching versions
Microsoft » Windows Server 2008 » Version: N/A Update SP2
cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*
Matching versions
Microsoft » Windows Server 2012 » Version: N/A
cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*
Matching versions
Microsoft » Windows Server 2012 » Version: R2
cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*
Matching versions
Microsoft » Windows Server 2016 » Version: N/A
cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*
Matching versions
Microsoft » Sharepoint Enterprise Server » Version: 2016
cpe:2.3:a:microsoft:sharepoint_enterprise_server:2016:*:*:*:*:*:*:*
Matching versions
Microsoft » Windows Server 2022 » Version: N/A
cpe:2.3:o:microsoft:windows_server_2022:-:*:*:*:*:*:*:*
Matching versions
Microsoft » Windows 11 21h2
Versions before (<) 10.0.22000.1936
cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:*
Matching versions
Microsoft » Windows 11 22h2
Versions before (<) 10.0.22000.1702
cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:*
Matching versions
Microsoft » Windows 10 1607
Versions before (<) 10.0.14393.5921
cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:*:*
Matching versions
Microsoft » Windows 10 1809
Versions before (<) 10.0.17763.4377
cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:*
Matching versions
Microsoft » Windows 10 21h2
Versions before (<) 10.0.19044.2965
cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*
Matching versions
Microsoft » Windows 10 20h2
Versions before (<) 10.0.19042.2965
cpe:2.3:o:microsoft:windows_10_20h2:*:*:*:*:*:*:*:*
Matching versions
Microsoft » Windows 10 22h2
Versions before (<) 10.0.19045.2965
cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:*
Matching versions
Microsoft » Windows 10 1507
Versions before (<) 10.0.10240.19926
cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2023-24954

EPSS FAQ

0.05%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 22 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2023-24954

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
6.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N	2.8	3.6	Microsoft Corporation
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None

CWE ids for CVE-2023-24954

CWE-918 Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Assigned by: secure@microsoft.com (Secondary)

References for CVE-2023-24954

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24954

CVE-2023-24954 - Security Update Guide - Microsoft - Microsoft SharePoint Server Information Disclosure Vulnerability
Patch;Vendor Advisory

Jump to

Vulnerability Details : CVE-2023-24954

Products affected by CVE-2023-24954

Exploit prediction scoring system (EPSS) score for CVE-2023-24954

CVSS scores for CVE-2023-24954

CWE ids for CVE-2023-24954

References for CVE-2023-24954