CVE-2019-1443
Last modified
CVE-2019-1443 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. An information disclosure vulnerability exists in Microsoft SharePoint when an attacker uploads a specially crafted file to the SharePoint Server.An authenticated attacker who successfully exploited this vulnerability could potentially leverage SharePoint functionality to obtain SMB hashes.The security update addresses the vulnerability by correcting how SharePoint checks file content., aka 'Microsoft SharePoint Information Disclosure Vulnerability'.. EPSS estimates a 5.37% chance of exploitation in the next 30 days.
Description
An information disclosure vulnerability exists in Microsoft SharePoint when an attacker uploads a specially crafted file to the SharePoint Server.An authenticated attacker who successfully exploited this vulnerability could potentially leverage SharePoint functionality to obtain SMB hashes.The security update addresses the vulnerability by correcting how SharePoint checks file content., aka 'Microsoft SharePoint Information Disclosure Vulnerability'.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Microsoft | Sharepoint Enterprise Server | 2016 | — |
| Microsoft | Sharepoint Foundation | 2010 | Sp2 |
| Microsoft | Sharepoint Foundation | 2013 | Sp1 |
| Microsoft | Sharepoint Server | 2019 | — |
References
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1443Patch, Vendor Advisory
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1443Patch, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2019-1443?
How severe is CVE-2019-1443?
How do I fix CVE-2019-1443?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2019
- CVE-2019-14418An issue was discovered in Veritas Resiliency Platform (VRP)…8.8
- CVE-2019-1442A security feature bypass vulnerability exists when Microsof…5.5
- CVE-2019-14422An issue was discovered in in TortoiseSVN 1.12.1. The Tsvncm…
- CVE-2019-14423A Remote Code Execution (RCE) issue in the addon CUx-Daemon …8.8
- CVE-2019-14424A Local File Inclusion (LFI) issue in the addon CUx-Daemon 1…6.5
- CVE-2019-14427XSS exists in WEB STUDIO Ultimate Loan Manager 2.0 by adding…
- CVE-2019-14430plugin/Audit/Objects/AuditTable.php in YouPHPTube through 7.…
- CVE-2019-14431In MatrixSSL 3.8.3 Open through 4.2.1 Open, the DTLS server …9.8
- CVE-2019-14432Incorrect authentication of application WebSocket connection…
- CVE-2019-14433An issue was discovered in OpenStack Nova before 17.0.12, 18…6.5
- CVE-2019-14437The xiph_SplitHeaders function in modules/demux/xiph.h in Vi…
- CVE-2019-14438A heap-based buffer over-read in xiph_PackHeaders() in modul…
Are you affected by CVE-2019-1443?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST