CVE-2014-0251

Microsoft Windows SharePoint Services < - Authenticated RCE

Title source: llm
STIX 2.1

Description

Microsoft Windows SharePoint Services 3.0 SP3; SharePoint Server 2007 SP3, 2010 SP1 and SP2, and 2013 Gold and SP1; SharePoint Foundation 2010 SP1 and SP2 and 2013 Gold and SP1; Project Server 2010 SP1 and SP2 and 2013 Gold and SP1; Web Applications 2010 SP1 and SP2; Office Web Apps Server 2013 Gold and SP1; SharePoint Server 2013 Client Components SDK; and SharePoint Designer 2007 SP3, 2010 SP1 and SP2, and 2013 Gold and SP1 allow remote authenticated users to execute arbitrary code via crafted page content, aka "SharePoint Page Content Vulnerability."

References (2)

Core 2
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1030227

Scores

EPSS 0.1420
EPSS Percentile 96.1%

Details

CWE
CWE-94
Status published
Products (14)
microsoft/office_web_apps_server 2013 (2 CPE variants)
microsoft/project_server 2010 sp1 (2 CPE variants)
microsoft/project_server 2013 (2 CPE variants)
microsoft/sharepoint_designer 2007 sp3
microsoft/sharepoint_designer 2010 sp1 (2 CPE variants)
microsoft/sharepoint_designer 2013 (2 CPE variants)
microsoft/sharepoint_foundation 2010 sp1 (2 CPE variants)
microsoft/sharepoint_foundation 2013 (2 CPE variants)
microsoft/sharepoint_server 2007 sp3
microsoft/sharepoint_server 2010 sp1 (2 CPE variants)
... and 4 more
Published May 14, 2014
Tracked Since Feb 18, 2026