CVE-2021-31950

🗓️ 08 Jun 2021 22:46:21Reported by microsoftType

cve🔗 web.nvd.nist.gov📰️ 7 Media mentions👁 203 Views🌐 WEB

Microsoft SharePoint Server Spoofing Vulnerability CVE-2021-3195

Reporter	Title	Published	Views	Family All 27
0day.today	Microsoft SharePoint Server 16.0.10372.20060 - (GetXmlDataFromDataSource) SSRF Exploit	11 Jun 202100:00	–	zdt
Information Security Automation	Vulristics: Microsoft Patch Tuesdays Q2 2021	10 Jul 202100:14	–	avleonov
Circl	CVE-2021-31950	14 Jun 202107:41	–	circl
CNNVD	Microsoft Office SharePoint 代码问题漏洞	8 Jun 202100:00	–	cnnvd
CNVD	Microsoft SharePoint Server Spoofing Vulnerability (CNVD-2021-41122)	9 Jun 202100:00	–	cnvd
Cvelist	CVE-2021-31950 Microsoft SharePoint Server Spoofing Vulnerability	8 Jun 202122:46	–	cvelist
Exploit DB	Microsoft SharePoint Server 16.0.10372.20060 - 'GetXmlDataFromDataSource' Server-Side Request Forgery (SSRF)	11 Jun 202100:00	–	exploitdb
EUVD	EUVD-2021-18823	7 Oct 202500:30	–	euvd
Microsoft KB	Description of the security update for SharePoint Server 2019: June 8, 2021 (KB5001944)	8 Jun 202107:00	–	mskb
Microsoft KB	Description of the security update for SharePoint Enterprise Server 2016: June 8, 2021 (KB5001946)	8 Jun 202107:00	–	mskb

NVD

Vulners

Node

microsoft sharepoint_foundationMatch2013sp1

microsoft sharepoint_serverMatch2016enterprise

microsoft sharepoint_serverMatch2019

[
  {
    "vendor": "Microsoft",
    "product": "Microsoft SharePoint Enterprise Server 2016",
    "cpes": [
      "cpe:2.3:a:microsoft:sharepoint_server:2016:*:*:*:enterprise:*:*:*"
    ],
    "platforms": [
      "x64-based Systems"
    ],
    "versions": [
      {
        "version": "16.0.0",
        "lessThan": "16.0.5173.1000",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Microsoft SharePoint Server 2019",
    "cpes": [
      "cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*"
    ],
    "platforms": [
      "x64-based Systems"
    ],
    "versions": [
      {
        "version": "16.0.0",
        "lessThan": "16.0.10375.20000",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Microsoft SharePoint Foundation 2013 Service Pack 1",
    "cpes": [
      "cpe:2.3:a:microsoft:sharepoint_foundation:2013:sp1:*:*:*:*:*:*"
    ],
    "platforms": [
      "x64-based Systems"
    ],
    "versions": [
      {
        "version": "15.0.0",
        "lessThan": "15.0.5353.1000",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  }
]

Source	Link
packetstormsecurity	www.packetstormsecurity.com/files/163080/Microsoft-SharePoint-Server-16.0.10372.20060-Server-Side-Request-Forgery.html
portal	www.portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-31950

Parameter	Position	Path	Description	CWE
Url	path	/_vti_bin/{service}.asmx	SharePoint GetXmlDataFromDataSource SSRF via SOAP request	CWE-918
Method	path	/_vti_bin/{service}.asmx	SharePoint GetXmlDataFromDataSource SSRF via SOAP request	CWE-918
Headers	path	/_vti_bin/{service}.asmx	SharePoint GetXmlDataFromDataSource SSRF via SOAP request	CWE-918
PostData	path	/_vti_bin/{service}.asmx	SharePoint GetXmlDataFromDataSource SSRF via SOAP request	CWE-918
ContentType	path	/_vti_bin/{service}.asmx	SharePoint GetXmlDataFromDataSource SSRF via SOAP request	CWE-918

21 Nov 2024 06:06Current

7.4High risk

Vulners AI Score7.4

CVSS 25.5

CVSS 3.17.6 - 8.1

EPSS0.01679

CWE-918