Description

Microsoft SharePoint is a web application platform developed by Microsoft. Because of improper configuration an Anonymous user can enumerate the SharePoint user accounts by incrementing the ID parameter of userdisp.aspx.

Remediation

Restrict Anonymous Access to this page.

References

Fedon_Athcon_June11.pdf

SharePoint

Related Vulnerabilities

Tornado debug mode

Roundcube Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2015-5382)

FrontPage Identified

Plone CMS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2013-4194)

WordPress Plugin W3 Total Cache Multiple Vulnerabilities (0.9.4.1)

Severity

High

Classification

CWE-200 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Tags

Configuration Information Disclosure