CVE-2019-0604

State: Published
Severity: 9.8 Critical
Published: Mar 6, 2019
Updated: Oct 21, 2025
Reserved: Nov 26, 2018

Description

A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microsoft SharePoint Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0594.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-20 Improper Input Validation

Affected Products

Product	Versions
Microsoft SharePoint ServerMicrosoft	2010 Service Pack 2Affected 2019Affected
Microsoft SharePoint FoundationMicrosoft	2013 Service Pack 1Affected
Microsoft SharePoint Enterprise ServerMicrosoft	2016Affected

References

106914vdb-entry
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0604
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-0604government-resource

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.