CVE-2018-8635

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted authentication request to an affected SharePoint server, aka "Microsoft SharePoint Server Elevation of Privilege Vulnerability." This affects Microsoft SharePoint Server, Microsoft SharePoint.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
Microsoft	Microsoft SharePoint Server	2010 Service Pack 2
Microsoft	Microsoft SharePoint	Enterprise Server 2013 Service Pack 1; Enterprise Server 2016

References

http://www.securityfocus.com/bid/106121Third Party Advisory, VDB Entry
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8635Patch, Vendor Advisory
http://www.securityfocus.com/bid/106121Third Party Advisory, VDB Entry
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8635Patch, Vendor Advisory

Timeline

Published: Dec 12, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-86367.8A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka "CVE-2018-86375.5An information disclosure vulnerability exists in Windows kernel that could allow an attacker to retrieve information that could lead to a K CVE-2018-86385.5An information disclosure vulnerability exists when DirectX improperly handles objects in memory, aka "DirectX Information Disclosure Vulner CVE-2018-86397.8An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k CVE-2018-86417.8An elevation of privilege vulnerability exists in Windows when the Windows kernel-mode driver fails to properly handle objects in memory, ak CVE-2018-86437.5A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scrip CVE-2018-86495.5A denial of service vulnerability exists when Windows improperly handles objects in memory, aka "Windows Denial of Service Vulnerability." T CVE-2018-86505.4A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web reques CVE-2018-86515.4A cross site scripting vulnerability exists when Microsoft Dynamics NAV does not properly sanitize a specially crafted web request to an aff CVE-2018-86525.4A Cross-site Scripting (XSS) vulnerability exists when Windows Azure Pack does not properly sanitize user-provided input, aka "Windows Azure CVE-2018-86537.5A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scrip CVE-2018-86546.5An elevation of privilege vulnerability exists in Microsoft Dynamics 365 Server, aka 'Microsoft Dynamics 365 Elevation of Privilege Vulnerab