CVE-2019-1257

HIGH

Microsoft SharePoint - Remote Code Execution via Application Package Source Markup

Title source: llm

Description

A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microsoft SharePoint Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1295, CVE-2019-1296.

References (1)

Core 1

Core References

Patch, Vendor Advisory x_refsource_misc

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1257

Scores

CVSS v3 8.8

EPSS 0.1091

EPSS Percentile 95.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-20

Status published

Products (4)

microsoft/sharepoint_enterprise_server 2016

microsoft/sharepoint_foundation 2010 sp2

microsoft/sharepoint_foundation 2013 sp1

microsoft/sharepoint_server 2019

Published Sep 11, 2019

Tracked Since Feb 18, 2026