CVE-2021-28478: 
vulnerability analysis and mitigation

Microsoft SharePoint Server Spoofing Vulnerability (CVE-2021-28478) was disclosed on May 11, 2021. This vulnerability affects multiple versions of SharePoint Server including SharePoint Foundation 2013 SP1, SharePoint Server 2016 Enterprise, and SharePoint Server 2019 (NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 7.1 (High) by NIST with vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N. Microsoft's assessment differs slightly with a CVSS score of 7.6 (High) and vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N. The vulnerability is classified under CWE-290 (Authentication Bypass by Spoofing) (NVD).

The vulnerability could allow an attacker to perform spoofing attacks against SharePoint Server installations, potentially leading to unauthorized access and information disclosure. The attack requires user interaction but could result in high confidentiality impact and low integrity impact (NVD).

The vulnerability requires network access and user interaction to exploit. It can be attacked remotely with low attack complexity, though specific exploit details have not been publicly disclosed (NVD).

Microsoft has released security updates to address this vulnerability. The fixes are included in the May 11, 2021 security updates for affected SharePoint versions. Organizations should apply KB5001916 for SharePoint Server 2019 or KB5001917 for SharePoint Enterprise Server 2016 (Microsoft Support).