CVE-2021-31171: 
vulnerability analysis and mitigation

Microsoft SharePoint Information Disclosure Vulnerability (CVE-2021-31171) was disclosed and patched as part of Microsoft's May 2021 security updates. The vulnerability affects multiple versions of SharePoint, including SharePoint Foundation 2013 SP1, SharePoint Server 2016 Enterprise, and SharePoint Server 2019 (NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 4.4 (Medium) by NIST with vector CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, while Microsoft assessed it with a slightly lower score of 4.1 (Medium) with vector CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N. The vulnerability requires local access and high privileges for exploitation (NVD).

This vulnerability could allow information disclosure if successfully exploited. The high confidentiality impact (C:H) in the CVSS score indicates that the vulnerability could lead to the disclosure of sensitive information, though it does not affect system integrity or availability (NVD).

The vulnerability requires local access and high privileges for exploitation, as indicated by the CVSS metrics (AV:L/PR:H). The attack complexity is rated as low by NIST and high by Microsoft, suggesting some disagreement about the difficulty of exploitation (NVD).

Microsoft released security updates to address this vulnerability in May 2021. The fixes are available through KB5001916 for SharePoint Server 2019 and KB5001917 for SharePoint Enterprise Server 2016. Organizations should apply these security updates to protect against potential exploitation (Microsoft Support).