CVE-2016-0011
MediumCVSS 5.4Exploitation Probability (EPSS)
Very high risk93th percentile - higher than 93% of all known CVEs
Summary
Microsoft SharePoint Server 2013 SP1 and SharePoint Foundation 2013 SP1 allow remote authenticated users to bypass intended Access Control Policy restrictions and conduct cross-site scripting (XSS) attacks by modifying a webpart, aka "Microsoft SharePoint Security Feature Bypass," a different vulnerability than CVE-2015-6117.
Risk Assessment
An authenticated attacker can conduct an XSS attack, potentially leading to session data theft or actions performed on behalf of the victim.
Recommendation
Apply Microsoft security updates for SharePoint Server 2013 SP1 and SharePoint Foundation 2013 SP1.
Other vulnerabilities in Microsoft SharePoint
See all- CVE-2026-45659HighActively exploited
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code remotely over a network.
- CVE-2024-38094HighActively exploited
A vulnerability in Microsoft SharePoint allows for remote code execution. The NVD description does not provide technical details or attack vectors.
- CVE-2023-33157High
A vulnerability in Microsoft SharePoint allows for remote code execution, potentially leading to unauthorized access to the system.
- CVE-2020-1102High
Remote code execution vulnerability in Microsoft SharePoint when the software fails to check the source markup of an application package. An attacker could run arbitrary code in the context of the SharePoint application pool and the SharePoint server farm account.
- CVE-2020-1024High
A remote code execution vulnerability in Microsoft SharePoint due to failure to check the source markup of application packages. An attacker could exploit it by uploading a specially crafted SharePoint application package. The update corrects how SharePoint checks source markup.
- CVE-2020-1023High
A remote code execution vulnerability in Microsoft SharePoint due to failure to check the source markup of application packages. An attacker could exploit it by uploading a specially crafted SharePoint application package. The update corrects how SharePoint checks source markup.
- CVE-2019-0604CriticalActively exploited
Microsoft SharePoint has a remote code execution vulnerability when the software fails to check the source markup of an application package, aka 'Microsoft SharePoint Remote Code Execution Vulnerability'.
- CVE-2015-6117Medium
Microsoft SharePoint Server 2013 SP1 and SharePoint Foundation 2013 SP1 allow remote authenticated users to bypass intended Access Control Policy restrictions and conduct cross-site scripting (XSS) attacks by modifying a webpart. This is known as "Microsoft SharePoint Security Feature Bypass" and is different from CVE-2016-0011.
Original NVD description (English source)
Microsoft SharePoint Server 2013 SP1 and SharePoint Foundation 2013 SP1 allow remote authenticated users to bypass intended Access Control Policy restrictions and conduct cross-site scripting (XSS) attacks by modifying a webpart, aka "Microsoft SharePoint Security Feature Bypass," a different vulnerability than CVE-2015-6117.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS