[{"vendor":"Microsoft","product":"Microsoft SharePoint Enterprise Server 2016","cpes":["cpe:2.3:a:microsoft:sharepoint_server:2016:*:*:*:enterprise:*:*:*"],"platforms":["x64-based Systems"],"versions":[{"version":"16.0.0","lessThan":"publication","versionType":"custom","status":"affected"}]},{"vendor":"Microsoft","product":"Microsoft SharePoint Enterprise Server 2013 Service Pack 1","cpes":["cpe:2.3:a:microsoft:sharepoint_server:2013:sp1:*:*:enterprise:*:*:*"],"platforms":["x64-based Systems"],"versions":[{"version":"15.0.0","lessThan":"publication","versionType":"custom","status":"affected"}]},{"vendor":"Microsoft","product":"Microsoft SharePoint Server 2019","cpes":["cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*"],"platforms":["x64-based Systems"],"versions":[{"version":"16.0.0","lessThan":"publication","versionType":"custom","status":"affected"}]},{"vendor":"Microsoft","product":"Microsoft SharePoint Server 2010 Service Pack 2","cpes":["cpe:2.3:a:microsoft:sharepoint_server:2010:sp2:*:*:*:*:*:*"],"platforms":["Unknown"],"versions":[{"version":"13.0.0.0","lessThan":"publication","versionType":"custom","status":"affected"}]}]

<p>A tampering vulnerability exists when Microsoft SharePoint Server fails to properly handle profile data. An attacker who successfully exploited this vulnerability could modify a targeted user's profile data.</p>
<p>To exploit the vulnerability, an attacker would need to be authenticated on an affected SharePoint Server. The attacker would then need to send a specially modified request to the server, targeting a specific user.</p>
<p>The security update addresses the vulnerability by modifying how Microsoft SharePoint Server handles profile data.</p>

<p>A tampering vulnerability exists when Microsoft SharePoint Server fails to properly handle profile data. An attacker who successfully exploited this vulnerability could modify a targeted user's profile data.</p>
<p>To exploit the vulnerability, an attacker would need to be authenticated on an affected SharePoint Server. The attacker would then need to send a specially modified request to the server, targeting a specific user.</p>
<p>The security update addresses the vulnerability by modifying how Microsoft SharePoint Server handles profile data.</p>

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1440

A tampering vulnerability exists when Microsoft SharePoint Server fails to properly handle profile data, aka 'Microsoft SharePoint Server Tampering Vulnerability'. This CVE ID is unique from CVE-2020-1523.

<p>A tampering vulnerability exists when Microsoft SharePoint Server fails to properly handle profile data. An attacker who successfully exploited this vulnerability could modify a targeted user's profile data.</p>
<p>To exploit the vulnerability, an attacker would need to be authenticated on an affected SharePoint Server. The attacker would then need to send a specially modified request to the server, targeting a specific user.</p>
<p>The security update addresses the vulnerability by modifying how Microsoft SharePoint Server handles profile data.</p>

Microsoft Corporation AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

CWE-20

NVD-CWE-noinfo

NIST AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

NIST (AV:N/AC:L/Au:S/C:N/I:P/A:N)

NIST CWE-20

OR
     *cpe:2.3:a:microsoft:sharepoint_enterprise_server:2013:sp1:*:*:*:*:*:*
     *cpe:2.3:a:microsoft:sharepoint_enterprise_server:2016:*:*:*:*:*:*:*
     *cpe:2.3:a:microsoft:sharepoint_server:2010:sp2:*:*:*:*:*:*
     *cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1440 No Types Assigned

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1440 Patch, Vendor Advisory