The Cybersecurity and Infrastructure Security Agency (CISA) has issued a critical advisory regarding newly discovered vulnerabilities in Microsoft SharePoint, specifically addressing a deserialization vulnerability now included in CISA’s Known Exploited Vulnerability (KEV) catalog.
The vulnerability in question, identified as CVE-2024-38094, has a CVSSv3.1 score of 7.2, which indicates a high-severity risk. It affects several SharePoint products, including Microsoft SharePoint Server Subscription Edition, Microsoft SharePoint Server 2019, and Microsoft SharePoint Enterprise Server 2016.
An authenticated attacker with Site Owner permissions could exploit this vulnerability to inject and execute arbitrary code within the SharePoint environment. The risk of such exploitation is exacerbated by the availability of proof-of-concept (PoC) code in the public domain, heightening the urgency for organizations to act swiftly.
CISA’s inclusion of vulnerabilities in the Known Exploited Vulnerabilities (KEV) catalog highlights that these issues are actively being exploited in real-world scenarios, indicating a threat to organizations.
Specifically, high-severity vulnerabilities like CVE-2024-38094 allow authenticated users with Site Owner permissions to inject arbitrary code into SharePoint Server, leading to potential consequences such as data breaches, ransomware attacks, and privilege escalation.
Organizations using affected SharePoint versions must prioritize timely patching and implement security measures to combat these threats. This advisory aligns with the established Common Vulnerabilities and Exposures (CVE) framework and the Common Vulnerability Scoring System (CVSS), which categorizes vulnerabilities into high (7.0-10.0), medium (4.0-6.9), and low (0.0-3.9) based on their severity. Importantly, a patch for CVE-2024-38094 is available, and its exploitation in the public domain underscores the urgency for organizations to act.
CISA urges organizations to take the following steps to mitigate risks associated with CVE-2024-38094 and similar vulnerabilities:
CISA’s advisory highlights the ongoing threats posed by vulnerabilities such as CVE-2024-38094 in Microsoft SharePoint. Organizations must not only recognize the seriousness of these vulnerabilities but also take decisive action to fortify their defenses.
By implementing timely patches and security measures, organizations can reduce their risk of exploitation and maintain the integrity of their systems. Prompt attention to these vulnerabilities is not just advisable; it is essential for protecting sensitive data and maintaining operational security.