It has been discovered by the cybersecurity expert MalwareHunterTeam. The lure is a supposed unusually activity on the victim’s account. The goal: steal PII and sensitive data.
Microsoft SharePoint server has a new vulnerability: CVE-2020-16952. It can be exploited when a user uploads a specially crafted application package to an affected version of the software
Microsoft SharePoint server ha a new vulnerability, the CVE-2020-16952, that could let an attacker take control of an affected system. It has been unveiled by the United Kingdom National CyberSecurity Centre (NCSC). According the experts, it is a caused by a validation issue in user-supplied data. This flaw can be exploited by cybercrime actors when a user uploads a specially crafted application package to an affected version of SharePoint. The affected versions are:
Microsoft SharePoint Foundation 2013 Service Pack 1
Microsoft SharePoint Enterprise Server 2016
Microsoft SharePoint Server 2019
However, SharePoint Online as part of Office 365 is not affected. The October 2020 SharePoint security update addresses the vulnerability by correcting how SharePoint checks the source markup of application packages. Furthermore, Microsoft published an advisory wich inludes links to these updates.