CVE-2019-0604
critical · 9.8Actively exploitedOn the CISA Known Exploited Vulnerabilities catalog
Apply updates per vendor instructions.
Added 2021-11-03Remediation due 2022-05-03
A public exploit / detection template exists
Weaponised detection is publicly available, which meaningfully raises real-world risk regardless of CVSS. nuclei-templates →
A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microsoft SharePoint Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0594.
9.8
CVSS
99.9%
EPSS (exploit prob.)
100th
EPSS percentile
2019-03-05
Published
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-20
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| microsoft | sharepoint_enterprise_server | 2016 |
| microsoft | sharepoint_foundation | 2013 |
| microsoft | sharepoint_server | 2010 |
| microsoft | sharepoint_server | 2019 |
Check a specific version with /api/v1/cve/match.
References
- http://www.securityfocus.com/bid/106914
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0604
- http://www.securityfocus.com/bid/106914
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0604
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-0604
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2019-0604