by Kastro
Paper/Archive/CVE-2019-0604

CVE-2019-0604

Microsoft Microsoft SharePoint Server — Microsoft SharePoint Remote Code Execution Vulnerability

KEV · due 3 Mayransomware useEPSS 100%public exploitSSVC actCVSS 9.8
critical.is priorityof 100
99
CVSS 9.8 (ADP)9.8 / 10 × 3029.4In CISA KEV+3030.0EPSS percentile 100.01.000 × 2020.0Exploit: SSVC active+1010.0SSVC exploitation: active+1010.0
Description · from the CVE record

A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microsoft SharePoint Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0594.

Affected

ProductAffectedFixed inSource
Microsoft SharePoint Server2010 Service Pack 2–CNA
Microsoft SharePoint Server2019–CNA
Microsoft SharePoint Foundation2013 Service Pack 1–CNA
Microsoft SharePoint Enterprise Server2016–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total

References

refsecurityfocus.com/bid/106914refportal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0604refcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-0604kevcisa.gov/known-exploited-vulnerabilities-catalog