CVE-2021-31172

🗓️ 11 May 2021 19:11:24Reported by microsoftType

cve🔗 web.nvd.nist.gov📰️ 7 Media mentions👁 150 Views🌐 WEB

Microsoft SharePoint Server Spoofing Vulnerabilit

Reporter	Title	Published	Views	Family All 24
BDU FSTEC	The vulnerability of Microsoft SharePoint Server, SharePoint Foundation, and SharePoint Enterprise Server relates to information representation errors in the user interface, allowing attackers to perform spear-phishing attacks.	2 Jun 202100:00	–	bdu_fstec
CNNVD	Microsoft SharePoint 安全漏洞	11 May 202100:00	–	cnnvd
CNVD	Microsoft SharePoint Spoofing Vulnerability	12 May 202100:00	–	cnvd
Cvelist	CVE-2021-31172 Microsoft SharePoint Server Spoofing Vulnerability	11 May 202119:11	–	cvelist
EUVD	EUVD-2021-18085	7 Oct 202500:30	–	euvd
Microsoft KB	Description of the security update for SharePoint Server 2019: May 11, 2021 (KB5001916)	11 May 202107:00	–	mskb
Microsoft KB	Description of the security update for SharePoint Enterprise Server 2016: May 11, 2021 (KB5001917)	11 May 202107:00	–	mskb
Microsoft KB	Description of the security update for SharePoint Foundation 2013: May 11, 2021 (KB5001935)	11 May 202107:00	–	mskb
Kaspersky	KLA12175 Multiple vulnerabilities in Microsoft Office	11 May 202100:00	–	kaspersky
Microsoft CVE	Microsoft SharePoint Server Spoofing Vulnerability	11 May 202107:00	–	mscve

NVD

Vulners

Node

microsoft sharepoint_foundationMatch2013sp1

microsoft sharepoint_serverMatch2016enterprise

microsoft sharepoint_serverMatch2019

[
  {
    "vendor": "Microsoft",
    "product": "Microsoft SharePoint Enterprise Server 2016",
    "cpes": [
      "cpe:2.3:a:microsoft:sharepoint_server:2016:*:*:*:enterprise:*:*:*"
    ],
    "platforms": [
      "x64-based Systems"
    ],
    "versions": [
      {
        "version": "16.0.0",
        "lessThan": "16.0.5161.1000",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Microsoft SharePoint Server 2019",
    "cpes": [
      "cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*"
    ],
    "platforms": [
      "x64-based Systems"
    ],
    "versions": [
      {
        "version": "16.0.0",
        "lessThan": "16.0.10374.20000",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Microsoft SharePoint Foundation 2013 Service Pack 1",
    "cpes": [
      "cpe:2.3:a:microsoft:sharepoint_foundation:2013:sp1:*:*:*:*:*:*"
    ],
    "platforms": [
      "x64-based Systems"
    ],
    "versions": [
      {
        "version": "15.0.0",
        "lessThan": "15.0.5345.1000",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  }
]

Source	Link
portal	www.portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-31172

Parameter	Position	Path	Description	CWE
X-Frame-Options	header	/oauthauthorize	Missing X-Frame-Options header on oauthauthorize page can lead to spoofing and disclosure of authorization code in OAuth2 authorization code grant.	CWE-290

17 Jun 2026 03:51Current

6.8Medium risk

Vulners AI Score6.8

CVSS 25.8

CVSS 3.17.1

EPSS0.01812

SSVC

CWE-290