| Vendor |
|
| Product | Sharepoint Online |
| Affected Version(s) | N/A and probably prior |
| Tested Version(s) | N/A |
| Vendor Notification | 24 January 2025 |
| Advisory Publication | 24 January 2025 [without technical details] |
| Vendor Fix | N/A |
| Public Disclosure | 24 January 2025 |
| Latest Modification | 24 January 2025 |
| CVE Identifier | Pending |
| Product Description | SharePoint Online is a cloud-based collaboration and document management platform offered by Microsoft as part of the Microsoft 365 suite. It enables organizations to create, manage, and share content and resources securely across teams and departments. SharePoint Online combines features like document libraries, lists, intranet sites, and workflows with seamless integration with other Microsoft 365 applications. |
| Credits | Emanuele Bramucci & Yann Chalençon - Security Consultants & Researchers @wizlynx group |
| Sharepoint Online Email Spoofing Vulnerability - SpoofPoint | |||
| Severity: High | CVSS Score: 8.8 | CWE-ID: CWE-A | Status: Open |
| Vulnerability Description | |||
| A vulnerability has been identified in Microsoft SharePoint Online Services that allows attackers to send arbitrary emails, fully customizing the subject line, body content, and recipient list, while appearing to originate from official Microsoft service email addresses. This issue is the result of a chain of weaknesses in the file-sharing functionality, which attackers can exploit to abuse email-sending capabilities and impersonate trusted Microsoft services. | |||
| CVSS Base Score | |||
| Attack Vector | Network | Scope | Changed |
| Attack Complexity | Low | Confidentiality Impact | Low |
| Privileges Required | None | Integrity Impact | High |
| User Interaction | Required | Availability Impact | Low |
Full details about the vulnerability will be disclosed once the vendor has provided a patch.