CVE-2021-31181

🗓️ 11 May 2021 19:11:30Reported by microsoftType

cve🔗 web.nvd.nist.gov📰️ 10 Media mentions👁 258 Views🌐 WEB

Microsoft SharePoint Remote Code Execution Vulnerabilit

Reporter	Title	Published	Views	Family All 32
0day.today	Microsoft SharePoint Unsafe Control And ViewState Remote Code Execution Exploit	17 Jun 202100:00	–	zdt
ATTACKERKB	CVE-2021-31181	11 May 202100:00	–	attackerkb
Information Security Automation	Vulristics: Microsoft Patch Tuesdays Q2 2021	10 Jul 202100:14	–	avleonov
BDU FSTEC	The vulnerability of components of Microsoft SharePoint Server, SharePoint Foundation, and SharePoint Enterprise Server allows a perpetrator to execute arbitrary code.	26 May 202100:00	–	bdu_fstec
Circl	CVE-2021-31181	3 Jun 202107:14	–	circl
CNNVD	Microsoft SharePoint 代码注入漏洞	11 May 202100:00	–	cnnvd
CNVD	Microsoft SharePoint Remote Code Execution Vulnerability	12 May 202100:00	–	cnvd
Check Point Advisories	Microsoft SharePoint Remote Code Execution (CVE-2021-31181)	11 May 202100:00	–	checkpoint_advisories
Cvelist	CVE-2021-31181 Microsoft SharePoint Remote Code Execution Vulnerability	11 May 202119:11	–	cvelist
Microsoft KB	Description of the security update for SharePoint Server 2019: May 11, 2021 (KB5001916)	11 May 202107:00	–	mskb

NVD

Vulners

Node

microsoft sharepoint_enterprise_serverMatch2016

microsoft sharepoint_foundationMatch2013sp1

microsoft sharepoint_serverMatch2019

[
  {
    "vendor": "Microsoft",
    "product": "Microsoft SharePoint Enterprise Server 2016",
    "cpes": [
      "cpe:2.3:a:microsoft:sharepoint_server:2016:*:*:*:enterprise:*:*:*"
    ],
    "platforms": [
      "x64-based Systems"
    ],
    "versions": [
      {
        "version": "16.0.0",
        "lessThan": "16.0.5161.1000",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Microsoft SharePoint Server 2019",
    "cpes": [
      "cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*"
    ],
    "platforms": [
      "x64-based Systems"
    ],
    "versions": [
      {
        "version": "16.0.0",
        "lessThan": "16.0.10374.20000",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Microsoft SharePoint Foundation 2013 Service Pack 1",
    "cpes": [
      "cpe:2.3:a:microsoft:sharepoint_foundation:2013:sp1:*:*:*:*:*:*"
    ],
    "platforms": [
      "x64-based Systems"
    ],
    "versions": [
      {
        "version": "15.0.0",
        "lessThan": "15.0.5345.1000",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  }
]

Source	Link
zerodayinitiative	www.zerodayinitiative.com/advisories/ZDI-21-573/
packetstormsecurity	www.packetstormsecurity.com/files/163208/Microsoft-SharePoint-Unsafe-Control-And-ViewState-Remote-Code-Execution.html
portal	www.portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-31181
packetstorm	www.packetstorm.news/files/id/163208

Parameter	Position	Path	Description	CWE
RenderWebPartForEdit	request body	_vti_bin/WebPartPages.asmx	RenderWebPartForEdit endpoint is used to process ASPX markup and can bypass SafeControl verification via unsafe XmlDataSource usage.	CWE-94
XmlDataSource	request body	_vti_bin/WebPartPages.asmx	RenderWebPartForEdit endpoint is used to process ASPX markup and can bypass SafeControl verification via unsafe XmlDataSource usage.	CWE-94
WebPartPagesXslTListFormWebPart	request body	_vti_bin/WebPartPages.asmx	RenderWebPartForEdit endpoint is used to process ASPX markup and can bypass SafeControl verification via unsafe XmlDataSource usage.	CWE-94
DataSources	request body	_vti_bin/WebPartPages.asmx	RenderWebPartForEdit endpoint is used to process ASPX markup and can bypass SafeControl verification via unsafe XmlDataSource usage.	CWE-94
xmldatasource	request body	_vti_bin/WebPartPages.asmx	RenderWebPartForEdit endpoint is used to process ASPX markup and can bypass SafeControl verification via unsafe XmlDataSource usage.	CWE-94
XPath	request body	_vti_bin/WebPartPages.asmx	RenderWebPartForEdit endpoint is used to process ASPX markup and can bypass SafeControl verification via unsafe XmlDataSource usage.	CWE-94
datafile	request body	_vti_bin/WebPartPages.asmx	RenderWebPartForEdit endpoint is used to process ASPX markup and can bypass SafeControl verification via unsafe XmlDataSource usage.	CWE-94
__VIEWSTATE	query param	_layouts/15/success.aspx	Success page used to deserialize and execute forged VIEWSTATE, enabling remote code execution when combined with a valid VIEWSTATE payload.	CWE-94

28 Feb 2025 21:15Current

8.7High risk

Vulners AI Score8.7

CVSS 26.5

CVSS 3.18.8

EPSS0.40655

SSVC

CWE-94