SRC-2021-0003 : Microsoft SharePoint Server SPSqlDataSource Information Disclosure Vulnerability (patch bypass)

🗓️ 09 Dec 2020 00:00:00Reported by Steven Seeley (mr_me) of Qihoo 360 Vulcan TeamType

Microsoft SharePoint Server SPSqlDataSource Information Disclosure Vulnerability (patch bypass) allows remote attackers to disclose sensitive information. Vulnerability exists within the SPSqlDataSource class due to lack of proper validation of the user-supplied ConnectionString property, enabling file disclosure in some cases

Reporter	Title	Published	Views	Family All 24
BDU FSTEC	The vulnerability of Microsoft SharePoint Server, SharePoint Foundation, and SharePoint Enterprise Server lies in the lack of protection for operational data, allowing attackers to gain unauthorized access to protected information.	23 Feb 202100:00	–	bdu_fstec
CNNVD	Microsoft SharePoint 信息泄露漏洞	9 Feb 202100:00	–	cnnvd
CNVD	Microsoft SharePoint Information Disclosure Vulnerability (CNVD-2021-48895)	21 Feb 202100:00	–	cnvd
CVE	CVE-2021-24071	25 Feb 202123:01	–	cve
Cvelist	CVE-2021-24071 Microsoft SharePoint Information Disclosure Vulnerability	25 Feb 202123:01	–	cvelist
EUVD	EUVD-2021-10987	7 Oct 202500:30	–	euvd
Microsoft KB	Description of the security update for SharePoint Server 2019: February 9, 2021 (KB4493194)	9 Feb 202108:00	–	mskb
Microsoft KB	Description of the security update for SharePoint Enterprise Server 2016: February 9, 2021 (KB4493195)	9 Feb 202108:00	–	mskb
Microsoft KB	Description of the security update for SharePoint Foundation 2013: February 9, 2021 (KB4493210)	9 Feb 202108:00	–	mskb
Microsoft KB	Description of the security update for SharePoint Foundation 2010: February 9, 2021 (KB4493223)	9 Feb 202108:00	–	mskb