TI-2018-00877 Aliases CVE-2018-0944 GHSA-jv9f-492h-3rf8

Cross-site scripting in Microsoft SharePoint

MEDIUM 45CWE-79Published 2018-03-14 · Updated 2024-09-16

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

Microsoft Project Server 2013 SP1 and Microsoft SharePoint Enterprise Server 2016 allows an elevation of privilege vulnerability to due how specially crafted web requests are sanitized, aka "Microsoft SharePoint Elevation of Privilege Vulnerability". This CVE is unique from CVE-2018-0909, CVE-2018-0910. CVE-2018-0911, CVE-2018-0912, CVE-2018-0913 CVE-2018-0914, CVE-2018-0915, CVE-2018-0916, CVE-2018-0917, CVE-2018-0921, CVE-2018-0923 and CVE-2018-0947.

Why it matters now

EPSS 0.04528 91st percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Microsoft	Microsoft SharePoint	Microsoft Project Server 2013 SP1 and Microsoft SharePoint Enterprise Server 2016	—	No fix listed	CNA

Microsoft SharePoint VendorMicrosoft Affected Microsoft Project Server 2013 SP1 and Microsoft SharePoint Enterprise Server 2016 Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:microsoft:project_server:2013:sp1::::::	2013 sp1	Vulnerable	Microsoft
cpe:2.3:a:microsoft:sharepoint_enterprise_server:2016:::::::*	2016	Vulnerable	Microsoft

cpe:2.3:a:microsoft:project_server:2013:sp1:*:*:*:*:*:* Versions 2013 sp1 Vulnerable ·Microsoft
cpe:2.3:a:microsoft:sharepoint_enterprise_server:2016:*:*:*:*:*:*:* Versions 2016 Vulnerable ·Microsoft

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2018-0944
2026-10-03 Alias added: GHSA-jv9f-492h-3rf8

References

Patch 1

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0944

TI-2018-05989 Code injection in Microsoft .NET Framework CVSS 3.0HIGH 8.1
TI-2009-00094 Microsoft Project 2000 SR1 and 2002 SP1, and Office Project 2003 SP3, does not properly… CVSS 2.0HIGH 9.3
TI-2015-02200 Microsoft Access 2007 SP3, Excel 2007 SP3, InfoPath 2007 SP3, OneNote 2007 SP3… CVSS 2.0HIGH 9.3
TI-2014-00243 Microsoft Windows SharePoint Services 3.0 SP3; SharePoint Server 2007 SP3, 2010 SP1 and… CVSS 2.0HIGH 9.0
TI-2017-00256 Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2016, Office Online… CVSS 3.0HIGH 7.8
TI-2006-06361 projectserver/logon/pdsrequest.asp in Microsoft Project Server 2003 allows remote… CVSS 2.0MEDIUM 6.5

See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences