{"schema":"threatline.record/2","record":{"id":"CVE-2019-0604","aliases":[],"summary":"Microsoft SharePoint Remote Code Execution Vulnerability","details":"Microsoft SharePoint fails to check the source markup of an application package. An attacker who successfully exploits the vulnerability could run remote code in the context of the SharePoint application pool and the SharePoint server farm account.","categories":["Applications & CMS"],"product":"SharePoint","vendor":"Microsoft","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2019-0604","source_modified_at":"2025-10-21T23:45:42.715Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"Microsoft SharePoint Server","vendor":"Microsoft","versions":[{"status":"affected","version":"2010 Service Pack 2"},{"status":"affected","version":"2019"}],"defaultStatus":null},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2019-0604","source_modified_at":"2025-10-21T23:45:42.715Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"Microsoft SharePoint Foundation","vendor":"Microsoft","versions":[{"status":"affected","version":"2013 Service Pack 1"}],"defaultStatus":null},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2019-0604","source_modified_at":"2025-10-21T23:45:42.715Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"Microsoft SharePoint Enterprise Server","vendor":"Microsoft","versions":[{"status":"affected","version":"2016"}],"defaultStatus":null}],"fixed_versions":[],"cvss":9.8,"severity":"Critical","kev":{"listed":true,"date_added":"2021-11-03","due_date":"2022-05-03","required_action":"Apply updates per vendor instructions.","ransomware_campaign_use":"Known"},"epss":{"probability":0.99913,"percentile":0.99968,"score_date":"2026-10-23"},"published_at":"2019-03-06T00:00:00.000Z","modified_at":"2025-10-21T23:45:42.715Z","provenance":[{"source":"CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23T17:00:09.9001Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2019-0604","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2025-10-21T23:45:42.715Z"},{"source":"Exploit-DB","url":"https://www.exploit-db.com/exploits/48053","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2020-01-21"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-0604","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CISA KEV","CVE List","Exploit-DB","EPSS"],"references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-0604","source":"CISA KEV"},{"source":"CVE List","url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0604","tags":["x_refsource_CONFIRM","x_transferred"]},{"source":"CVE List","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-0604","tags":["government-resource"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CISA ADP","ssvc":{"exploitation":"active","automatable":"yes","technical_impact":"total","assessed_at":"2025-02-07T16:20:47.392214Z"},"exploits":[{"source":"Exploit-DB","kind":"Remote exploit","name":"Microsoft SharePoint - Deserialization Remote Code Execution","url":"https://www.exploit-db.com/exploits/48053","date":"2020-01-21","added":"2020-02-11","verified":false}],"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2025-10-21T23:45:42.715Z","content_hash":"95b7c48c3a11186b252819f9e7b40bc55cdce335d2bfdb4f2edb6675e765afea"}}