CVE-2019-1296: Input Validation

Published Sep 11, 2019

Updated

A remote code execution vulnerability exists in Microsoft SharePoint where APIs aren't properly protected from unsafe data input, aka 'Microsoft SharePoint Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1257, CVE-2019-1295.

Affected Software

3 affected components

Microsoft SharePoint Enterprise Server=2016

Microsoft SharePoint Foundation=2013-sp1

Microsoft SharePoint Server=2019

Remediation

Patch Available

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1296

Event History

Sep 11, 2019

CVE Published

via MITRE·09:25 PM

Data Sourced

via MITRE·09:25 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2019-1296?

CVE-2019-1296 has a critical severity rating due to its potential for remote code execution.

How do I fix CVE-2019-1296?

To fix CVE-2019-1296, apply the latest security updates provided by Microsoft for affected SharePoint versions.

Which software versions are affected by CVE-2019-1296?

CVE-2019-1296 affects Microsoft SharePoint Enterprise Server 2016, SharePoint Foundation 2013 SP1, and SharePoint Server 2019.

What types of attacks could exploit CVE-2019-1296?

CVE-2019-1296 could be exploited through specially crafted requests that result in remote code execution on the server.

Is CVE-2019-1296 specific to a particular SharePoint edition?

CVE-2019-1296 is not specific to one edition but affects multiple editions of SharePoint, including Enterprise and Foundation versions.