CVE-2023-29357
CISA 기관 조치 기한: 2024-01-31
Microsoft SharePoint Server
Qualys 위협 인텔 · 심각도 4/5 · QID 110439 · Office Application
공개 익스플로잇
실제 공격 관측
쉬운 악용
악성코드 연계
권한상승
인증 불필요
원격코드실행
랜섬웨어 연계
CISA KEV
Microsoft SharePoint Server contains an unspecified vulnerability that allows an unauthenticated attacker, who has gained access to spoofed JWT authentication tokens, to use them for executing a network attack. This attack bypasses authentication, enabling the attacker to gain administrator privileges.
KEV 필수 조치: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
벡터: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
공개 익스플로잇 / PoC
- GitHub 공개 PoC 4건 — 대표 레포 ↗