CVE-2019-0604
A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microsoft SharePoint Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0594.
- Score
- CVSS 3.1 9.8 Critical
- Status
- Analyzed - secure@microsoft.com
- Published
- 2019-03-05
- Last modified
- 2025-10-21
- Known exploited (CISA KEV)
- since 2021-11-03, action due 2022-05-03: Apply updates per vendor instructions.
- Weaknesses
- CWE-20
Affected products
- Microsoft Sharepoint Enterprise Server (Microsoft)
- Microsoft Sharepoint Foundation (Microsoft)
- Microsoft Sharepoint Server (Microsoft)
- Sharepoint Enterprise Server (Microsoft)
- Sharepoint Foundation (Microsoft)
- Sharepoint Server (Microsoft)
References
- http://www.securityfocus.com/bid/106914
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0604
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-0604
