Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Affected Vendors & Products

Vendors Products
Microsoft
  • Sharepoint Enterprise Server
  • Sharepoint Enterprise Server 2016
  • Sharepoint Enterprise Server 2019
  • Sharepoint Server

No data.

No data.

References
Link Providers
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53771 cve-icon cve-icon
https://www.bleepingcomputer.com/news/microsoft/microsoft-sharepoint-zero-day-exploited-in-rce-attacks-no-patch-available/ cve-icon
History

Wed, 23 Jul 2025 17:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

 ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 22 Jul 2025 21:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-20
CWE-22
CWE-707

Tue, 22 Jul 2025 21:15:00 +0000

Type Values Removed Values Added
Description Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
Weaknesses CWE-287
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N/E:P/RL:O/RC:C'}

 cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C'}

Mon, 21 Jul 2025 21:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N/E:U/RL:O/RC:C'}

 cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N/E:P/RL:O/RC:C'}

Mon, 21 Jul 2025 13:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 21 Jul 2025 00:30:00 +0000

Type Values Removed Values Added
References

Sun, 20 Jul 2025 22:30:00 +0000

Type Values Removed Values Added
Description Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
Title Microsoft SharePoint Server Spoofing Vulnerability
Weaknesses CWE-20
CWE-22
CWE-707
References
Metrics cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N/E:U/RL:O/RC:C'}
cve-icon MITRE

Status: PUBLISHED

Assigner: microsoft

Published: 2025-07-20T22:16:52.203Z

Updated: 2025-07-25T18:42:09.524Z

Reserved: 2025-07-09T13:25:25.501Z

Link: CVE-2025-53771

cve-icon Vulnrichment

Updated: 2025-07-20T23:40:49.866Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2025-07-20T23:15:31.807

Modified: 2025-07-22T21:15:46.910

Link: CVE-2025-53771

cve-icon Redhat

No data.