CVE-2023-29357

Name of the Vulnerable Software and Affected Versions Microsoft SharePoint Server (affected versions not specified)

Description An elevation of privilege issue exists in Microsoft SharePoint Server due to improper access control. Specifically, the ValidateTokenIssuer() function fails to properly verify cryptographic signatures, which can lead to an authentication bypass. This flaw allows an unauthenticated remote attacker to elevate their privileges on the system and potentially achieve remote code execution. There are approximately 2,500 internet-connected SharePoint servers globally that may be affected, with about 650 located in the RuNet region. This issue has been exploited in real-world scenarios, including during the Pwn2Own Vancouver 2023 competition.

Recommendations Apply update KB5002390 to resolve this issue.