CVE-2018-8580

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

An information disclosure vulnerability exists where certain modes of the search function in Microsoft SharePoint Server are vulnerable to cross-site search attacks (a variant of cross-site request forgery, CSRF), aka "Microsoft SharePoint Information Disclosure Vulnerability." This affects Microsoft SharePoint.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

VendorProductVersions
MicrosoftMicrosoft SharePointEnterprise Server 2013 Service Pack 1; Enterprise Server 2016; Foundation 2010 Service Pack 2

References

Timeline

Published
Dec 12, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-85817.4An elevation of privilege vulnerability exists in Microsoft Exchange Server, aka "Microsoft Exchange Server Elevation of Privilege VulnerabiCVE-2018-85828.8A remote code execution vulnerability exists in the way that Microsoft Outlook parses specially modified rule export files, aka "Microsoft OCVE-2018-85837.5A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "CCVE-2018-85847.8An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC), aka "Windows ACVE-2018-85877.8A remote code execution vulnerability exists in Microsoft Outlook software when it fails to properly handle objects in memory, aka "MicrosofCVE-2018-85887.5A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "CCVE-2018-85897.8An elevation of privilege vulnerability exists when Windows improperly handles calls to Win32k.sys, aka "Windows Win32k Elevation of PrivileCVE-2018-85926.4An elevation of privilege vulnerability exists in Windows 10 version 1809 when installed from physical media (USB, DVD, etc, aka "Windows ElCVE-2018-85956.5An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka "Windows CVE-2018-85966.5An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka "Windows CVE-2018-85977.8A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka "CVE-2018-85984.7An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory, aka "Microsoft Excel In
CVE-2018-8580: Medium severity, CVSS 4.3 | Vulnix