What is the vulnerability?
A vulnerability in Microsoft SharePoint Server is actively being exploited and targeting servers from Government, Telco and Education industries. The vulnerability tracked under CVE-2023-29357 is an authentication bypass vulnerability that adversaries may use to escalate privileges on affected installations of Microsoft SharePoint Server. Attackers may chain the vulnerability with other vulnerabilities for remote code execution to compromise the integrity, availability, and confidentiality of the target system.
What is the Vendor Solution?
Microsoft has released an official patch for the vulnerability CVE-2023-29357 in June, 2023.
[ Link ]
What FortiGuard Coverage is available?
FortiGuard Labs has protection coverage via IPS signature “MS.SharePoint.Server.CVE-2023-29357.Privilege.Escalation” for CVE-2023-29357 since June, 2023. Also, FortiGuard has coverage to detect any vulnerable systems via Endpoint Vulnerability.
FortiGuard Labs recommends companies to scan their environment, find vulnerable Microsoft SharePoint servers, and upgrade as per vendor advisory and always follow best practices.
More Stories
ZDI-CAN-25373: Microsoft
A CVSS score 7.0 AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H severity vulnerability discovered by 'Peter Girnus - Trend Micro Zero Day Initiative' was reported to...
DSA-5774-1 ruby-saml – security update
It was discovered that ruby-saml, a SAML library implementing the client side of a SAML authorization, does not properly verify...
USN-6968-2: PostgreSQL vulnerability
USN-6968-1 fixed CVE-2024-7348 in PostgreSQL-12, PostgreSQL-14, and PostgreSQL-16 This update provides the corresponding updates for PostgreSQL-9.5 in Ubuntu 16.04 LTS....
USN-7015-2: Python vulnerabilities
USN-7015-1 fixed several vulnerabilities in Python. This update provides one of the corresponding updates for python2.7 for Ubuntu 16.04 LTS,...
USN-7027-1: Emacs vulnerabilities
It was discovered that Emacs incorrectly handled input sanitization. An attacker could possibly use this issue to execute arbitrary commands....
USN-7024-1: tgt vulnerability
It was discovered that tgt attempts to achieve entropy by calling rand without srand. The PRNG seed is always 1,...