{"id":"CVE-2023-29357","published":"2023-06-14T00:15:09Z","modified":"2026-06-17T05:49:52Z","title":"Microsoft SharePoint Server Privilege Escalation Vulnerability","vendor":"Microsoft","product":"SharePoint Server","tier":"core","eol":null,"description":{"text":"Microsoft SharePoint Server Elevation of Privilege Vulnerability","provenance":"source","from":"NVD"},"summary":{"text":"A privilege escalation flaw in Microsoft SharePoint Server, classified as an incorrect implementation of an authentication algorithm, allows an attacker to elevate their privileges beyond what they were granted. Based on the vector, it is exploitable over the network with low complexity and requires no privileges or user interaction.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:10:55Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.99984,"percentile":0.99983,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2024-01-10","dueDate":"2024-01-31","ransomware":true,"requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-29357; https://nvd.nist.gov/vuln/detail/CVE-2023-29357","provenance":"source"},"vulncheckKev":{"dateAdded":"2023-11-16","exploitedFirstSeen":"2023-11-16","ransomware":true,"evidence":[{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-16&host_type=src&vulnerability=cve-2023-29357","date":"2023-11-16"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-12-04&host_type=src&vulnerability=cve-2023-29357","date":"2023-12-04"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-12-10&host_type=src&vulnerability=cve-2023-29357","date":"2023-12-10"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-12-19&host_type=src&vulnerability=cve-2023-29357","date":"2023-12-19"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-12-20&host_type=src&vulnerability=cve-2023-29357","date":"2023-12-20"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-12-21&host_type=src&vulnerability=cve-2023-29357","date":"2023-12-21"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-12-25&host_type=src&vulnerability=cve-2023-29357","date":"2023-12-25"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2024-01-10"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-22&host_type=src&vulnerability=cve-2023-29357","date":"2024-01-22"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-24&host_type=src&vulnerability=cve-2023-29357","date":"2024-01-24"}],"evidenceTotal":580,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-303","name":"Incorrect Implementation of Authentication Algorithm"}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-29357","tags":["Patch","Vendor Advisory"]},{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-29357","tags":["Patch","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-29357","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Network-exploitable public-facing SharePoint server, no privileges required","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"Microsoft SharePoint Server Elevation of Privilege Vulnerability","start":0,"end":64}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1068","name":"Exploitation for Privilege Escalation","tactics":["privilege-escalation"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Vulnerability directly yields privilege escalation","mappingType":"primary_impact","evidence":[{"from":"description","quote":"Microsoft SharePoint Server Elevation of Privilege Vulnerability","start":0,"end":64}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2023-32930","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-32930","exploited":true,"exploitedSince":"2024-01-10","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":7,"skipped":2,"earliest":"2023-09-26","earliestUrl":"https://github.com/Chocapikk/CVE-2023-29357","repos":[{"name":"Chocapikk/CVE-2023-29357","url":"https://github.com/Chocapikk/CVE-2023-29357","stars":236,"created":"2023-09-26"},{"name":"LuemmelSec/CVE-2023-29357","url":"https://github.com/LuemmelSec/CVE-2023-29357","stars":55,"created":"2023-09-30"},{"name":"Guillaume-Risch/cve-2023-29357-Sharepoint","url":"https://github.com/Guillaume-Risch/cve-2023-29357-Sharepoint","stars":4,"created":"2023-12-22"},{"name":"KeyStrOke95/CVE-2023-29357-ExE","url":"https://github.com/KeyStrOke95/CVE-2023-29357-ExE","stars":3,"created":"2023-10-10"},{"name":"Jev1337/CVE-2023-29357-Check","url":"https://github.com/Jev1337/CVE-2023-29357-Check","stars":1,"created":"2024-01-01"}]},"metasploit":[{"name":"Sharepoint Dynamic Proxy Generator Unauth RCE","module":"exploit/windows/http/sharepoint_dynamic_proxy_generator_auth_bypass_rce","type":"exploit","disclosureDate":"2023-05-01","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/sharepoint_dynamic_proxy_generator_auth_bypass_rce.rb"}],"nuclei":[{"id":"CVE-2023-29357","name":"Microsoft SharePoint - Authentication Bypass","severity":"critical","path":"http/cves/2023/CVE-2023-29357.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-29357.yaml"}],"first":{"date":"2023-05-01","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/sharepoint_dynamic_proxy_generator_auth_bypass_rce.rb"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1068"],"provenance":"ai"}],"timeline":[{"date":"2023-05-01","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2023-09-26","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/sharepoint_dynamic_proxy_generator_auth_bypass_rce.rb","provenance":"source"},{"date":"2023-06-14","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-29357","provenance":"source"},{"date":"2023-11-16","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-16&host_type=src&vulnerability=cve-2023-29357","provenance":"source"},{"date":"2024-01-10","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2024-01-10","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-32930","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":210},"priority":{"score":79.9,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1078 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":20.0,"detail":"percentile 0.9998"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"7 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}