Description

Microsoft SharePoint is a web application platform developed by Microsoft. Because of improper configuration an Anonymous user can enumerate the SharePoint user accounts by incrementing the ID parameter of userdisp.aspx.

Remediation

Restrict Anonymous Access to this page.

References

Fedon_Athcon_June11.pdf

SharePoint

Related Vulnerabilities

Atlassian JIRA Servicedesk misconfiguration

WordPress 4.7 Multiple Vulnerabilities (4.7)

PostgreSQL Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2017-7484)

Unprotected Apache NiFi API interface

WordPress Plugin ShareYourCart Information Disclosure (1.6.1)

Severity

High

Classification

CWE-200 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Tags

Configuration Information Disclosure