CVE-2021-31181

🗓️ 11 May 2021 19:11:30Reported by microsoftType

cve🔗 web.nvd.nist.gov📰️ 10 Media mentions👁 275 Views🌐 WEB

Microsoft SharePoint Remote Code Execution Vulnerabilit

Reporter	Title	Published	Views	Family All 32
0day.today	Microsoft SharePoint Unsafe Control And ViewState Remote Code Execution Exploit	17 Jun 202100:00	–	zdt
ATTACKERKB	CVE-2021-31181	11 May 202100:00	–	attackerkb
Information Security Automation	Vulristics: Microsoft Patch Tuesdays Q2 2021	10 Jul 202100:14	–	avleonov
BDU FSTEC	The vulnerability of components of Microsoft SharePoint Server, SharePoint Foundation, and SharePoint Enterprise Server allows a perpetrator to execute arbitrary code.	26 May 202100:00	–	bdu_fstec
Circl	CVE-2021-31181	3 Jun 202107:14	–	circl
CNNVD	Microsoft SharePoint 代码注入漏洞	11 May 202100:00	–	cnnvd
CNVD	Microsoft SharePoint Remote Code Execution Vulnerability	12 May 202100:00	–	cnvd
Check Point Advisories	Microsoft SharePoint Remote Code Execution (CVE-2021-31181)	11 May 202100:00	–	checkpoint_advisories
Cvelist	CVE-2021-31181 Microsoft SharePoint Remote Code Execution Vulnerability	11 May 202119:11	–	cvelist
Microsoft KB	Description of the security update for SharePoint Server 2019: May 11, 2021 (KB5001916)	11 May 202107:00	–	mskb

NVD

Vulners

Node

microsoft sharepoint_enterprise_serverMatch2016

microsoft sharepoint_foundationMatch2013sp1

microsoft sharepoint_serverMatch2019

[
  {
    "vendor": "Microsoft",
    "product": "Microsoft SharePoint Enterprise Server 2016",
    "cpes": [
      "cpe:2.3:a:microsoft:sharepoint_server:2016:*:*:*:enterprise:*:*:*"
    ],
    "platforms": [
      "x64-based Systems"
    ],
    "versions": [
      {
        "version": "16.0.0",
        "lessThan": "16.0.5161.1000",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Microsoft SharePoint Server 2019",
    "cpes": [
      "cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*"
    ],
    "platforms": [
      "x64-based Systems"
    ],
    "versions": [
      {
        "version": "16.0.0",
        "lessThan": "16.0.10374.20000",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Microsoft SharePoint Foundation 2013 Service Pack 1",
    "cpes": [
      "cpe:2.3:a:microsoft:sharepoint_foundation:2013:sp1:*:*:*:*:*:*"
    ],
    "platforms": [
      "x64-based Systems"
    ],
    "versions": [
      {
        "version": "15.0.0",
        "lessThan": "15.0.5345.1000",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  }
]

Source	Link
portal	www.portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-31181
zerodayinitiative	www.zerodayinitiative.com/advisories/ZDI-21-573/
packetstormsecurity	www.packetstormsecurity.com/files/163208/Microsoft-SharePoint-Unsafe-Control-And-ViewState-Remote-Code-Execution.html
packetstorm	www.packetstorm.news/files/id/163208

Parameter	Position	Path	Description	CWE
RenderWebPartForEdit	request body	/_vti_bin/WebPartPages.asmx	RenderWebPartForEdit endpoint used to inject unsafe server controls via XML/ASPX markup and bypass SafeControl verification to achieve RCE	CWE-94
XmlDataSource	request body	/_vti_bin/WebPartPages.asmx	RenderWebPartForEdit endpoint used to inject unsafe server controls via XML/ASPX markup and bypass SafeControl verification to achieve RCE	CWE-94
XsltListFormWebPart	request body	/_vti_bin/WebPartPages.asmx	RenderWebPartForEdit endpoint used to inject unsafe server controls via XML/ASPX markup and bypass SafeControl verification to achieve RCE	CWE-94
id	path	/_api/web/id	Endpoint used to obtain the webId of a site for PoC/attack preparation	CWE-264
webId	path	/_api/web/id	Endpoint used to obtain the webId of a site for PoC/attack preparation	CWE-264
title	path	/_layouts/15/viewlsts.aspx	Used to retrieve the title of an SPList to target in the PoC	CWE-264
ListDisplayName	path	/_layouts/15/viewlsts.aspx	Used to retrieve the title of an SPList to target in the PoC	CWE-264
__VIEWSTATEGENERATOR	query param	/_layouts/15/success.aspx	Page used to obtain a valid VIEWSTATE for deserialization-based RCE via ViewState forgery	CWE-94
__VIEWSTATE	query param	/_layouts/15/success.aspx	Page used to obtain a valid VIEWSTATE for deserialization-based RCE via ViewState forgery	CWE-94
__VIEWSTATEGENERATOR	query param	/_layouts/15/success.aspx	Page used to obtain a valid VIEWSTATE for deserialization-based RCE via ViewState forgery	CWE-94

17 Jun 2026 03:51Current

8.7High risk

Vulners AI Score8.7

CVSS 26.5

CVSS 3.18.8

EPSS0.30045

SSVC

CWE-94