CVE-2019-1202
SharePoint Information Disclosure Vulnerability
Published Aug 14, 2019
CVSS 3.0 · 4.4 Medium
EPSS 1.6%
KEV · Not listed
Description
An information disclosure vulnerability exists in the way Microsoft SharePoint handles session objects. An authenticated attacker who successfully exploited the vulnerability could hijack the session of another user.
To exploit this vulnerability, the attacker could run a specially crafted application.
The security update corrects how SharePoint handles session objects to prevent user session hijacking.
To exploit this vulnerability, the attacker could run a specially crafted application.
The security update corrects how SharePoint handles session objects to prevent user session hijacking.
Affected Products
-
CVE record
-
NVD configurations
-
Red Hat packages
No data
-
OpenCVE enrichment
No data
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Microsoft | Microsoft SharePoint Enterprise Server 2016 | affected |
|
||||||
| Microsoft | Microsoft SharePoint Foundation 2010 Service Pack 2 | affected |
|
||||||
| Microsoft | Microsoft SharePoint Foundation 2013 Service Pack 1 | affected |
|
||||||
| Microsoft | Microsoft SharePoint Server 2019 | affected |
|
Configuration 1 [-]
|
No data.
No data available yet.
Remediation
Tracking
Advisories
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2019-9770 | An information disclosure vulnerability exists in the way Microsoft SharePoint handles session objects. An authenticated attacker who successfully exploited the vulnerability could hijack the session of another user. To exploit this vulnerability, the attacker could run a specially crafted application. The security update corrects how SharePoint handles session objects to prevent user session hijacking. |
Metrics
No CVSS v4.0
No CVSS v3.1
Attack Vector Local
Attack Complexity Low
Privileges Required Low
Scope Unchanged
Confidentiality Impact Low
Integrity Impact Low
Availability Impact None
User Interaction None
Access Vector Local
Access Complexity Low
Authentication None
Confidentiality Impact Partial
Integrity Impact Partial
Availability Impact None
This CVE is not in the KEV list.
Exploit prediction score: 1.6% (1.589% probability within 30 days)
Key SSVC decision points have not yet been added.
References
History
Feb 20, 2026 9:00 PM
Description updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| Description | An information disclosure vulnerability exists in the way Microsoft SharePoint handles session objects. An authenticated attacker who successfully exploited the vulnerability could hijack the session of another user. To exploit this vulnerability, the attacker could run a specially crafted application. The security update corrects how SharePoint handles session objects to prevent user session hijacking. | An information disclosure vulnerability exists in the way Microsoft SharePoint handles session objects. An authenticated attacker who successfully exploited the vulnerability could hijack the session of another user. To exploit this vulnerability, the attacker could run a specially crafted application. The security update corrects how SharePoint handles session objects to prevent user session hijacking. |
Subscriptions
Weaknesses
