An elevation of privilege vulnerability exists in Microsoft Project when Microsoft Project Server does not properly manage user sessions. For this Cross-site Request Forgery(CSRF/XSRF) vulnerability to be exploited, the victim must be authenticated to (logged on) the target site.
In a web-based attack scenario an attacker could host a website (or leverage a compromised website that accepts or hosts user-provided content) that contains a specially crafted webpage that is designed to exploit the vulnerability. An attacker would have no way to force users to visit the website. Instead, an attacker would have to convince users to click a link, typically by way of an enticement in an email or Instant Messenger message. An attacker who successfully exploited this vulnerability could read content that the attacker is not authorized to read, use the victim's identity to take actions on the web application on behalf of the victim, such as change permissions and delete content, and inject malicious content in the browser of the victim.
The update addresses the vulnerability by modifying how Microsoft Project Server manages user session authentication.
## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Microsoft | Microsoft Project Server 2013 Service Pack 1 (64-bit edition) | | [KB4011257](https://patchblox.com/security/data/fix/microsoft/kb4011257.md) | Nov 14, 2017 | | Microsoft | Microsoft SharePoint Enterprise Server 2016 | | [KB4011244](https://patchblox.com/security/data/fix/microsoft/kb4011244.md) | Nov 14, 2017 | --- Data as of 2026-11-07T12:40:37Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo