CVE-2019-1202

medium Microsoft
CVSS v3 Base Score
4.4
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
EPSS Score
0.6%
Exploitation probability in 30 days
Top 31% most likely to be exploited
Attack Characteristics
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Published: August 14, 2019 (2465 days ago)
Last Modified: February 20, 2026
Vendor: Microsoft

Description

An information disclosure vulnerability exists in the way Microsoft SharePoint handles session objects. An authenticated attacker who successfully exploited the vulnerability could hijack the session of another user. To exploit this vulnerability, the attacker could run a specially crafted application. The security update corrects how SharePoint handles session objects to prevent user session hijacking.

CWE

CWE-200

Affected Products

microsoft sharepoint enterprise servermicrosoft sharepoint foundationmicrosoft sharepoint server

References

🔗 portal.msrc.microsoft.com 🔗 portal.msrc.microsoft.com