// Exploit Title: Microsoft SharePoint Enterprise Server 2016 - Spoofing// Date: 2023-06-20// country: Iran// Exploit Author: Amirhossein Bahramizadeh// Category : Remote// Vendor Homepage:// Microsoft SharePoint Foundation 2013 Service Pack 1// Microsoft SharePoint Server Subscription Edition// Microsoft SharePoint Enterprise Server 2013 Service Pack 1// Microsoft SharePoint Server 2019// Microsoft SharePoint Enterprise Server 2016// Tested on: Windows/Linux//
READ MORE
The CVE-2020-17118 bug was discovered by Jonathan Birch, a Senior Security Software Engineer on the Microsoft Office Security Team.
The critical flaw affects the following versions of SharePoint: Microsoft SharePoint Server 2019, Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Foundation 2013 Service Pack 1, and Microsoft SharePoint Foundation 2010 Service Pack 2.
Speaking to Threatpost, Kevin Breen - the director of cyberthreat research at Immersive Labs - said the SharePoint CVEs are a priority to fix.
Breen said: Both are rated as critical as they have RCE, and Sharepoint can be used like a watering hole inside large organisations by an attacker. All it takes is for a few weaponised documents to be placed for malicious code to spread across an organisation.