{"id":"CVE-2019-1202","url":"https://www.cyber-defence.io/tools/cve/CVE-2019-1202","generatedAt":"2026-10-29T03:46:14.427Z","title":"An information disclosure vulnerability exists in the way Microsoft SharePoint handles session objects.","description":"An information disclosure vulnerability exists in the way Microsoft SharePoint handles session objects. An authenticated attacker who successfully exploited the vulnerability could hijack the session of another user.\nTo exploit this vulnerability, the attacker could run a specially crafted application.\nThe security update corrects how SharePoint handles session objects to prevent user session hijacking.","published":"2019-08-14T21:15:18.000Z","lastModified":"2026-06-17T02:28:04.000Z","status":"Modified","sourceIdentifier":"secure@microsoft.com","cvss":{"version":"3.0","score":4.4,"severity":"MEDIUM","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"},"cwe":["CWE-200"],"affected":["microsoft/sharepoint enterprise server","microsoft/sharepoint foundation","microsoft/sharepoint server"],"epss":{"score":0.01589,"percentile":0.75551,"date":"2026-10-28","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (1.59%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1202","tags":["Patch","Vendor Advisory"],"source":"secure@microsoft.com"},{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1202","tags":["Patch","Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2019-1202","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}