CVE-2019-1202

MediumCVSS 4.4/10Last modified Jun 17, 2026

Description

An information disclosure vulnerability exists in the way Microsoft SharePoint handles session objects. An authenticated attacker who successfully exploited the vulnerability could hijack the session of another user. To exploit this vulnerability, the attacker could run a specially crafted application. The security update corrects how SharePoint handles session objects to prevent user session hijacking.

Metrics

CVSS 3.0 4.4/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-200

Affected software

VendorProductVersions
MicrosoftMicrosoft SharePoint Enterprise Server 2016>= 16.0.0, < publication
MicrosoftMicrosoft SharePoint Foundation 2010 Service Pack 2>= 13.0.0, < publication
MicrosoftMicrosoft SharePoint Foundation 2013 Service Pack 1>= 15.0.0, < publication
MicrosoftMicrosoft SharePoint Server 2019>= 16.0.0, < publication

References

Timeline

Published
Aug 14, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-12035.4A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web requesCVE-2019-12044.3An elevation of privilege vulnerability exists when Microsoft Outlook initiates processing of incoming messages without sufficient validatioCVE-2019-120417.5lib/common/html_re.js in remarkable 1.7.1 allows Regular Expression Denial of Service (ReDoS) via a CDATA section.CVE-2019-120429.8Insecure permissions of the section object Global\PandaDevicesAgentSharedMemory and the event Global\PandaDevicesAgentSharedMemoryChange in CVE-2019-120436.1In remarkable 1.7.1, lib/parser_inline.js mishandles URL filtering, which allows attackers to trigger XSS via unprintable characters, as demCVE-2019-120447.5A Buffer Overflow exists in Citrix NetScaler Gateway 10.5.x before 10.5.70.x, 11.1.x before 11.1.59.10, 12.0.x before 12.0.59.8, and 12.1.x CVE-2019-120469.8LemonLDAP::NG -2.0.3 has Incorrect Access Control.CVE-2019-120476.1Gridea v0.8.0 has an XSS vulnerability through which the Nodejs module can be called to achieve arbitrary code execution, as demonstrated byCVE-2019-12059.8A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory. An attacker who CVE-2019-12067.5A memory corruption vulnerability exists in the Windows Server DHCP service when an attacker sends specially crafted packets to a DHCP failoCVE-2019-120676.5The ahci_commit_buf function in ide/ahci.c in QEMU allows attackers to cause a denial of service (NULL dereference) when the command header CVE-2019-120683.8In QEMU 1:4.1-1, 1:2.1+dfsg-12+deb8u6, 1:2.8+dfsg-6+deb9u8, 1:3.1+dfsg-8~deb10u1, 1:3.1+dfsg-8+deb10u2, and 1:2.1+dfsg-12+deb8u12 (fixed), w