CVE-2018-0916: XSS

Published Mar 14, 2018

Updated

Microsoft Project Server 2013 SP1 and Microsoft SharePoint Enterprise Server 2016 allow an elevation of privilege vulnerability to due how specially crafted web requests are sanitized, aka "Microsoft SharePoint Elevation of Privilege Vulnerability". This CVE is unique from CVE-2018-0909, CVE-2018-0910. CVE-2018-0911, CVE-2018-0912, CVE-2018-0913 CVE-2018-0914, CVE-2018-0915, CVE-2018-0917, CVE-2018-0921, CVE-2018-0923, CVE-2018-0944 and CVE-2018-0947.

Affected Software

2 affected components

Microsoft Project Server=2013-sp1

Microsoft SharePoint Enterprise Server=2016

Remediation

Patch Available

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0916

Event History

Mar 14, 2018

CVE Published

via MITRE·05:00 PM

Data Sourced

via MITRE·05:00 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2018-0916?

CVE-2018-0916 has a severity rating of important, indicating a significant risk of privilege escalation.

How do I fix CVE-2018-0916?

To fix CVE-2018-0916, apply the latest updates provided by Microsoft for Project Server 2013 SP1 and SharePoint Enterprise Server 2016.

Who is affected by CVE-2018-0916?

CVE-2018-0916 affects users of Microsoft Project Server 2013 SP1 and Microsoft SharePoint Enterprise Server 2016.

What type of vulnerability is CVE-2018-0916?

CVE-2018-0916 is classified as an elevation of privilege vulnerability due to improper sanitization of web requests.

Can CVE-2018-0916 be exploited remotely?

Yes, CVE-2018-0916 can be exploited remotely by an attacker who sends specially crafted web requests.