CVE-2022-30158HighCVSS 8.8

Microsoft SharePoint Server Remote Code Execution Vulnerability

Published
June 14, 2022
Last Modified
—

🔗 CVE IDs covered (1)

CVE-2022-30158 →

📋 Description

According to the CVSS metric, privileges required is low (PR:L). What does that mean for this vulnerability? The attacker must be authenticated and possess the permissions for page creation to be able to exploit this vulnerability.

I am running SharePoint Enterprise Server 2013 Service Pack 1. Do I need to install both updates that are listed for SharePoint Enterprise Server 2013 Service Pack 1? No. The Cumulative update for SharePoint Server 2013 includes the update for Foundation Server 2013. Customers running SharePoint Server 2013 Service Pack 1 can install the cumulative update or the security update, which is the same update as for Foundation Server 2013. Please note that this is a clarification of the existing servicing model for SharePoint Server 2013 and applies for all previous updates.

How can an attacker exploit this vulnerability via the Network? An authenticated attacker with access to a server that has Sandboxed Code Service enabled could execute code in the context of the web service account.

🎯 Affected products5

  • Microsoft SharePoint Enterprise Server 2016
  • Microsoft SharePoint Foundation 2013 Service Pack 1
  • Microsoft SharePoint Server 2013 Service Pack 1
  • Microsoft SharePoint Server 2019
  • Microsoft SharePoint Server Subscription Edition

✅ Remediation

KB5002222 (Security Update) — fixed build 16.0.5332.1001 KB5002212 (Security Update) — fixed build 16.0.10387.20008 KB5002224 (Security Update) — fixed build 16.0.14931.20418 KB5002219 (Security Update) — fixed build 15.0.5459.1001 KB5002218 (Cumulative Update) — fixed build 15.0.5459.1001

🔗 References (7)