Published: 15/12/2021 Updated: 28/12/2023

CVSS v2 Base Score: 6.5 | Impact Score: 6.4 | Exploitability Score: 8

CVSS v3 Base Score: 8.8 | Impact Score: 5.9 | Exploitability Score: 2.8

VMScore: 578

Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P

This vulnerability allows remote malicious users to execute arbitrary code on affected installations of Microsoft SharePoint. Authentication is required to exploit this vulnerability. The specific flaw exists within the handling of server-side controls. An unsafe server-side control can be instantiated if it is specified as a child of a permitted control. An attacker can leverage this vulnerability to execute code in the context of the service account.

Vulnerable Product	Search on Vulmon	Subscribe to Product
microsoft sharepoint foundation 2013
microsoft sharepoint enterprise server 2016
microsoft sharepoint server 2019
microsoft sharepoint server -

Microsoft closes installer hole abused by Emotet malware, Google splats Chrome bug exploited in the wild

The Register • Chris Williams, Editor in Chief • 15 Dec 2021

Get our weekly newsletter Round off the year with a large crop of fixes for programming blunders

Patch Tuesday It's not just Log4j you need to worry about this week. It's the final Patch Tuesday of the year. If you haven't already installed these fixes, or started testing them ahead of deployment, now would be a good time before exploits are developed and deployed over the Christmas break. At least two of them – one in Windows AppX Installer and one in Chrome – are being exploited in the wild right now. Let's start with Microsoft, which put out a summary of its security updates here. Al...

CVE-2021-42309

Vulnerability Summary

Vulnerability Trend

Recent Articles

References

Vulmon Search

About

Products

Connect