CVE-2023-36891

Deeper analysis

Microsoft SharePoint Server is affected by CVE-2023-36891, a spoofing vulnerability assigned CWE-79 that carries a CVSS 3.1 base score of 8.0. The flaw permits an attacker to present falsified content or identity information through the server, with the network attack vector, low complexity, and low privileges required indicating that authenticated users can trigger the issue remotely.

An attacker who already possesses low-privileged access can exploit the vulnerability by crafting requests that require user interaction on the target side; successful exploitation can result in high impact to confidentiality, integrity, and availability of SharePoint content and sessions.

The Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36891 describes available security updates and configuration guidance for affected SharePoint Server versions.

EPSS for the CVE rose from a low baseline after disclosure to a peak of 0.0741 on 2025-01-22 before receding to the current value of 0.0026, indicating a period of increased exploitation interest well after the original publication date.