{"id":"CVE-2018-8431","published":"2018-09-13T00:00:00Z","modified":"2024-08-05T06:54:36Z","title":"An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially…","vendor":"Microsoft","product":"Microsoft SharePoint Server","tier":"core","eol":null,"affectedVersions":[{"vendor":"Microsoft","product":"Microsoft SharePoint Server","versions":["2010 Service Pack 2"]},{"vendor":"Microsoft","product":"Microsoft SharePoint","versions":["Enterprise Server 2013 Service Pack 1","Enterprise Server 2016"]}],"description":{"text":"An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka \"Microsoft SharePoint Elevation of Privilege Vulnerability.\" This affects Microsoft SharePoint Server, Microsoft SharePoint. This CVE ID is unique from CVE-2018-8428.","provenance":"source","from":"CVE.org"},"summary":null,"cvss":null,"epss":{"score":0.02253,"percentile":0.82867,"date":"2026-10-28","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[],"references":[{"url":"http://www.securitytracker.com/id/1041639","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8431","tags":["x_refsource_CONFIRM"]},{"url":"http://www.securityfocus.com/bid/105221","tags":["vdb-entry","x_refsource_BID"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 2)","mappingType":"primary_impact","evidence":[],"confidence":"high"},{"id":"T1565","name":"Data Manipulation","tactics":["impact"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 2)","mappingType":"secondary_impact","evidence":[],"confidence":"high"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2018-20067","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-20067","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[{"stage":"primary","techniques":["T1190"],"provenance":"source"},{"stage":"secondary","techniques":["T1565"],"provenance":"source"}],"timeline":[{"date":"2018-09-13","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2018-8431","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":16.6,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":16.57,"detail":"percentile 0.8287"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}