CVE-2019-0952

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A remote code execution vulnerability exists in Microsoft SharePoint Server when it fails to properly identify and filter unsafe ASP.Net web controls, aka 'Microsoft SharePoint Server Remote Code Execution Vulnerability'.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

VendorProductVersions
MicrosoftMicrosoft SharePoint Foundation2013 Service Pack 1
MicrosoftMicrosoft SharePoint Enterprise Server2016

References

Timeline

Published
May 16, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-09537.8A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory, aka 'Microsoft WCVE-2019-09566.5An information disclosure vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request tCVE-2019-09578.8An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request tCVE-2019-09588.8An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request tCVE-2019-09597.0An elevation of privilege vulnerability exists when the Windows Common Log File System (CLFS) driver improperly handles objects in memory. ACVE-2019-09607.0An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory. An attacker CVE-2019-09616.5An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows CVE-2019-09624.9An elevation of privilege vulnerability exists in Azure Automation "RunAs account" runbooks for users with contributor role, aka 'Azure AutoCVE-2019-09635.4A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web requesCVE-2019-09657.6A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated usCVE-2019-09666.8A denial of service vulnerability exists when Microsoft Hyper-V on a host server fails to properly validate input from a privileged user on CVE-2019-09685.5An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory. An attacker w
CVE-2019-0952: High severity, CVSS 8.8 | Vulnix