CVE-2020-1440: 
vulnerability analysis and mitigation

A tampering vulnerability (CVE-2020-1440) was identified in Microsoft SharePoint Server that affects its ability to properly handle profile data. The vulnerability was discovered and assigned on November 4, 2019, with patches released on September 8, 2020. This vulnerability affects multiple versions of SharePoint, including SharePoint Enterprise Server 2013 SP1, SharePoint Enterprise Server 2016, SharePoint Server 2010 SP2, and SharePoint Server 2019 (NVD Database).

The vulnerability received a CVSS v3.1 base score of 4.3 (MEDIUM) from NIST with a vector string of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, while Microsoft assessed it with a higher score of 6.3 (MEDIUM) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L. The vulnerability is related to improper handling of profile data in SharePoint Server (NVD Database).

If successfully exploited, this vulnerability allows an attacker to modify a targeted user's profile data within the SharePoint Server environment. The impact is primarily focused on data integrity, with potential for unauthorized profile modifications (CVE Database).

To exploit this vulnerability, an attacker needs to be authenticated on an affected SharePoint Server and must send a specially modified request to the server targeting a specific user. The attack requires network access and low attack complexity (NVD Database).

Microsoft has released security updates to address this vulnerability by modifying how SharePoint Server handles profile data. The fix is included in the September 8, 2020 security update. Users should note that the update has dependencies on KB 4484525, and installation of both updates is required to avoid search page functionality issues (Microsoft Support).