An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted authentication request to an affected SharePoint server. An attacker who successfully exploited this vulnerability could execute malicious code on a vulnerable server in the context of the SharePoint application pool account.
To exploit this vulnerability, an authenticated attacker would need to create a page specifically designed to cause a server-side request. The attacker would then send a specially-crafted message to perform a server-side request forgery attack.
The update addresses the vulnerability by modifying how Microsoft SharePoint Server manages server authentication.
## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Microsoft | Microsoft SharePoint Enterprise Server 2013 Service Pack 1 | | [KB4461558](https://patchblox.com/security/data/fix/microsoft/kb4461558.md) | Dec 11, 2018 | | Microsoft | Microsoft SharePoint Enterprise Server 2016 | | [KB4461541](https://patchblox.com/security/data/fix/microsoft/kb4461541.md) | Dec 11, 2018 | | Microsoft | Microsoft SharePoint Server 2010 Service Pack 2 | | [KB4461465](https://patchblox.com/security/data/fix/microsoft/kb4461465.md) | Dec 11, 2018 | --- Data as of 2026-11-07T12:40:37Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo