Microsoft SharePoint Server Remote Code Execution Vulnerability

According to the CVSS metric, privileges required is low (PR:L). What does that mean for this vulnerability? Within a SharePoint site, the attacker must be authenticated, and they would need to have the “Use Remote Interfaces” and “Add and Customize Pages” permissions on a Policy Center site to be able to exploit this vulnerability.

What is the attack vector for this vulnerability? In a network-based attack, the attacker must be authenticated to a SharePoint Online tenant associated with a hybrid deployment to tamper with data. This tampered data is synchronized down to the on-premises server and exploits the vulnerability. The attackers code will run in the context of the SharePoint timer service on the on-premises server.