Microsoft SharePoint CVE-2019-1202 Information Disclosure Vulnerability

Description

An information disclosure vulnerability exists in the way Microsoft SharePoint handles session objects. A locally authenticated attacker who successfully exploited the vulnerability could hijack the session of another user. To exploit this vulnerability, the attacker could run a specially crafted application. The security update corrects how SharePoint handles session objects to prevent user session hijacking.

Affected Applications

Microsoft SharePoint Server 2019
Microsoft SharePoint Foundation 2013 Service Pack 1
Microsoft SharePoint Enterprise Server 2016
Microsoft SharePoint Foundation 2010 Service Pack 2

CVE References

Other References