{"schemaVersion":3,"id":"CVE-2018-0912","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Microsoft Project Server 2013 SP1 and Microsoft SharePoint Enterprise Server 2016 allow an elevation of privilege vulnerability to due how specially crafted web requests are sanitized, aka \"Microsoft SharePoint Elevation of Privilege Vulnerability\". This CVE is unique from CVE-2018-0909, CVE-2018-0910. CVE-2018-0911, CVE-2018-0913, CVE-2018-0914, CVE-2018-0915, CVE-2018-0916, CVE-2018-0917, CVE-2018-0921, CVE-2018-0923, CVE-2018-0944 and CVE-2018-0947.","dates":{"published":"2018-03-14T17:00:00.000Z","modified":"2024-09-16T20:37:01.739Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":8.8,"severity":"high","version":"3.0","versionLabel":"v3.0","source":"NVD","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.0","versionLabel":"v3.0","source":"NVD","score":8.8,"severity":"high","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":6.5,"severity":"medium","vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.04528,"percentile":0.91445,"severity":"low","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.04528},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.04528,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.04528,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.04528,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.04528,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.04528,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.04528,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.04528,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.04096,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.04528,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.04528,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.04528,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.04528,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.04528,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.04528,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.04528,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.04528,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.04528,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.04528,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.04528,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.04528,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.04528,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.04528,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.04528,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.04528,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.04528,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.04528,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.04528,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.04528,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.04528,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.04528,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.04528,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.04528,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.04528,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.04528,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.04528,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.04528,"percentile":0.91445}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.04528,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.04528,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.04096,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.04528,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.04528,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.04528,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.04528,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.04528,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.04528,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.04528,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.04528,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.04528,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.04528,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.04528,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.04528,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.04528,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.04528,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.04528,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.04528,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.04528,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.04528,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.04528,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.04528,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.04528,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.04528,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.04528,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.04528,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.04528,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.04528,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.04528,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.04528,"percentile":0.91445}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.","type":"weakness","status":"Stable","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/79.html"}],"affected":[{"vendor":"microsoft corporation","product":"microsoft sharepoint","name":"Microsoft SharePoint","label":"microsoft sharepoint","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"Microsoft Project Server 2013 SP1 and Microsoft SharePoint Enterprise Server 2016","noFixRecorded":false,"fixedIn":null}],"versionsText":"Microsoft Project Server 2013 SP1 and Microsoft SharePoint Enterprise Server 2016","eol":{"isEol":null,"eolDate":null,"matchMethod":"name_exact","cycle":null,"product":{"name":"sharepoint","label":"Microsoft SharePoint","category":"server-app"}},"hubHref":"/vendor/microsoft_corporation/microsoft_sharepoint"},{"vendor":"microsoft","product":"project_server","name":"project server","label":"project_server","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"2013:sp1","noFixRecorded":false,"fixedIn":null}],"versionsText":"2013:sp1","eol":null,"hubHref":"/vendor/microsoft/project_server"},{"vendor":"microsoft","product":"sharepoint_enterprise_server","name":"sharepoint enterprise server","label":"sharepoint_enterprise_server","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"2016","noFixRecorded":false,"fixedIn":null}],"versionsText":"2016","eol":null,"hubHref":"/vendor/microsoft/sharepoint_enterprise_server"}],"affectedCount":3,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0912","label":"portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0912","hostname":"portal.msrc.microsoft.com","tags":["X Refsource CONFIRM","Patch","Vendor Advisory"]},{"url":"http://www.securitytracker.com/id/1040513","label":"www.securitytracker.com/id/1040513","hostname":"www.securitytracker.com","tags":["VDB Entry","X Refsource SECTRACK","Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/103285","label":"www.securityfocus.com/bid/103285","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID","Third Party Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2018-03-14T17:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-09-16T20:37:01.739Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":36,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T20:54:38.289Z","stale":false,"partial":false}}