CVE-2008-4032

Microsoft Office SharePoint Server and Search Server - Improper Authentication and Authorization

Title source: llm
STIX 2.1

Description

Microsoft Office SharePoint Server 2007 Gold and SP1 and Microsoft Search Server 2008 do not properly perform authentication and authorization for administrative functions, which allows remote attackers to cause a denial of service (server load), obtain sensitive information, and "create scripts that would run in the context of the site" via requests to administrative URIs, aka "Access Control Vulnerability."

References (6)

Core 6
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id?1021367
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2008/3389
Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5774
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/33063
US Government Resource third-party-advisory x_refsource_cert
http://www.us-cert.gov/cas/techalerts/TA08-344A.html

Scores

EPSS 0.4791
EPSS Percentile 98.7%

Details

CWE
CWE-287
Status published
Products (2)
microsoft/office_sharepoint_server 2007 (4 CPE variants)
microsoft/search_server 2008 (2 CPE variants)
Published Dec 10, 2008
Tracked Since Feb 18, 2026