Vulnerability in Microsoft Sharepoint Enterprise Server 2016
CVE-2020-16948
<p>An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user’s system.</p> <p>To exploit the vulnerability, an attacker would have to log on to an affected system and run a specially crafted application.</p> <p>The security update addresses the vulnerability by correcting how Microsoft SharePoint Server handles objects in memory.</p>
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.038 (89.8th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 90th percentile — 89.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.038 · newest: 0.038 · change: 0.000
Affected products
- Microsoft Sharepoint Enterprise Server 2016 — versions 16.0.0
- Microsoft Sharepoint Foundation 2010 Service Pack 2 — versions 13.0.0
- Microsoft Sharepoint Foundation 2013 Service Pack 1 — versions 15.0.0
- Microsoft Sharepoint Server 2019 — versions 16.0.0
- Microsoft Sharepoint Enterprise Server — versions 2016
- Microsoft Sharepoint Foundation — versions 2010, 2013
- Microsoft Sharepoint Server — versions 2019
References
- portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16948 (Patch, Vendor Advisory)
Frequently asked questions
- What is CVE-2020-16948?
- CVE-2020-16948 is a medium-severity vulnerability in Microsoft Sharepoint Enterprise Server 2016. CVSS score: 6.5/10. Published 2020-10-16.
- How severe is CVE-2020-16948?
- Medium severity. CVSS v3 base score is 6.5 out of 10.