CVE-2025-47166
HIGHMicrosoft SharePoint Enterprise Server - Remote Code Execution via Untrusted Data Deserialization
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2025-47166. PoCs published by nu11secur1ty.
AI-analyzed exploit summary This exploit demonstrates NTLM authentication bypass in Microsoft SharePoint 2019, allowing low-privileged or brute-forced domain accounts to access the `_api/web` endpoint and enumerate SharePoint metadata. The PoC uses NTLM authentication to disclose sensitive information such as user group relationships and file system structures.
Description
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
Exploits (1)
This exploit demonstrates NTLM authentication bypass in Microsoft SharePoint 2019, allowing low-privileged or brute-forced domain accounts to access the `_api/web` endpoint and enumerate SharePoint metadata. The PoC uses NTLM authentication to disclose sensitive information such as user group relationships and file system structures.
References (1)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H