---
cve: "CVE-2025-49704"
severity: "HIGH"
cvss: 8.8
epss: "100%"
vendor: "Microsoft"
kev: true
exploited: true
published: "2025-07-08 17:15:57"
tags: [cve, security, high]
source: tsecurity.de CVE-Dossier
exported: "2026-11-05T09:02:07+01:00"
---

# CVE-2025-49704

> 8.8 HIGH · ⚠️ CISA KEV (471 Tage) · 🔓 Exploited

## Beschreibung

Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

## CNA-Record (Kanon, cvelistV5)

- CNA: **microsoft**
- State: PUBLISHED
- Stand: 2026-02-13 19:07:40
- CNA-CVSS: **8.8** (`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C`)

## CISA-Anreicherung (vulnrichment/ADP)

- CISA KEV seit: **22.07.2025**
- CISA-SSVC (Coordinator, v2.0.3):
  - Exploitation: **active**
  - Automatable: **no**
  - Technical Impact: **total**

## CVSS-Vektor

```
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Gering | warn |
| UI Interaktion | Keine | bad |
| S Scope | Unverändert | good |
| C Vertraulichkeit | Hoch | bad |
| I Integrität | Hoch | bad |
| A Verfügbarkeit | Hoch | bad |

## Schwachstellen-Klasse

- **CWE-94** — Improper Control of Generation of Code
  The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

## Angriffsmuster (CAPEC)

- [CAPEC-35 — Leverage Executable Code in Non-Executable Files](https://capec.mitre.org/data/definitions/35.html) _(Severity: Very High)_
- [CAPEC-77 — Manipulating User-Controlled Variables](https://capec.mitre.org/data/definitions/77.html) _(Severity: Very High)_
- [CAPEC-242 — Code Injection](https://capec.mitre.org/data/definitions/242.html) _(Severity: High)_

## ATT&CK-Techniken

- [T1027.006 — Obfuscated Files or Information: HTML Smuggling](https://attack.mitre.org/techniques/T1027/006/)
- [T1027.009 — Obfuscated Files or Information: Embedded Payloads](https://attack.mitre.org/techniques/T1027/009/)
- [T1564.009 — Hide Artifacts: Resource Forking](https://attack.mitre.org/techniques/T1564/009/)

## BSI-Hinweise (deutsch)

- [Microsoft Office: Mehrere Schwachstellen](https://wid.cert-bund.de/portal/wid/sicherheitshinweis/WID-SEC-W-2025-1491) — _BSI-Einstufung: hoch_
  Ein entfernter, authentisierter Angreifer oder ein lokaler Angreifer kann mehrere Schwachstellen in Microsoft Excel 2016, Microsoft PowerPoint 2016, Microsoft Word 2016, Microsoft Office 2016, Microsoft Outlook 2016, Microsoft Office Online Server, Microsoft SharePoint, Microsoft Office 2019, Microsoft SharePoint Server 2019, Microsoft 365 Apps, Microsoft Teams und Microsoft Office ausnutzen, um Administratorrechte zu erlangen, um beliebigen Code auszuführen, vertrauliche Informationen offenzulegen, Sicherheitsmaßnahmen zu umgehen und Spoofing-Angriffe durchzuführen.

## Referenzen

- <https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49704>
- <https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-49704>
- <https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2025-49704/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_