Microsoft SharePoint 2010 SP2/2013 SP1/2016/2019 Session Object information disclosure

Summaryinfo

A vulnerability described as problematic has been identified in Microsoft SharePoint 2010 SP2/2013 SP1/2016/2019. This vulnerability affects unknown code of the component Session Object Handler. The manipulation results in information disclosure. This vulnerability is identified as CVE-2019-1202. The attack can be executed remotely. There is not any exploit available. It is advisable to implement a patch to correct this issue.

Detailsinfo

A vulnerability was found in Microsoft SharePoint 2010 SP2/2013 SP1/2016/2019 (Groupware Software). It has been classified as problematic. Affected is an unknown code block of the component Session Object Handler. The manipulation with an unknown input leads to a information disclosure vulnerability. CWE is classifying the issue as CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. This is going to have an impact on confidentiality. CVE summarizes:

An information disclosure vulnerability exists in the way Microsoft SharePoint handles session objects. An authenticated attacker who successfully exploited the vulnerability could hijack the session of another user. To exploit this vulnerability, the attacker could run a specially crafted application. The security update corrects how SharePoint handles session objects to prevent user session hijacking.

The weakness was released 08/13/2019 as confirmed security update guide (Website). The advisory is shared for download at portal.msrc.microsoft.com. The public release was coordinated with the vendor. This vulnerability is traded as CVE-2019-1202 since 11/26/2018. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1592. The advisory points out:

An information disclosure vulnerability exists in the way Microsoft SharePoint handles session objects. A locally authenticated attacker who successfully exploited the vulnerability could hijack the session of another user.

Applying a patch is able to eliminate this problem. A possible mitigation has been published immediately after the disclosure of the vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Groupware Software

Vendor

• Microsoft

Name

• SharePoint

Version

• 2010 SP2
• 2013 SP1
• 2016
• 2019

License

• commercial

Website

• Vendor: https://www.microsoft.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion