CVE-2024-30043: Microsoft SharePoint Server XXE information disclosure

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityUnauthenticated network-reachable information disclosure with a 7.5 CVSS score and very high EPSS percentile, though no confirmed in-the-wild exploitation is documented.

What it is

CVE-2024-30043 is an information disclosure flaw in Microsoft SharePoint Server, classified as CWE-611 XML external entity (XXE). It is remotely reachable over the network without authentication or user interaction, and the CVSS 3.1 base score is 7.5 (HIGH). The record does not specify affected versions or the exact vulnerable component.

Impact

An unauthenticated attacker can read data the vulnerable SharePoint process can access, resulting in high confidentiality impact. Integrity and availability are not affected per the CVSS vector.

Attack surface

Reached over the network via the SharePoint web interface (AV:N), with no privileges (PR:N) and no user interaction (UI:N) required. The XXE classification indicates crafted XML input is processed by the server.

Exploitation

Not listed in CISA KEV and no public exploit or ransomware use is documented in the record. EPSS is 0.54659 (98.97th percentile), indicating a high predicted likelihood of exploitation activity in the next 30 days.

What to do

• Apply the Microsoft May 2024 SharePoint Server security update referenced in the MSRC advisory.
• Inventory SharePoint Server instances and confirm patch level against the vendor advisory.
• Disable or restrict XML external entity and DTD processing in SharePoint-integrated XML parsers where configurable.
• Limit network exposure of SharePoint endpoints to trusted networks or authenticated users where operationally possible.
• Monitor SharePoint logs for anomalous XML payloads and unexpected outbound requests from the SharePoint host.

Detection

• Search SharePoint and IIS logs for requests containing DOCTYPE or ENTITY declarations in XML bodies.
• Monitor for outbound HTTP, SMB or file URI requests originating from SharePoint servers to unexpected destinations.
• Alert on unusual file reads or responses containing file contents from SharePoint web requests.
• Correlate SharePoint process activity with network connections to internal or external hosts not normally contacted.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.