PT-2020-2159 · Microsoft · Sharepoint Server

Hph0Var

+1

·

Published

2020-04-14

·

Updated

2025-02-28

·

CVE-2020-0930

CVSS v3.1

5.4

Medium

VectorAV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions Microsoft SharePoint Server (affected versions not specified) Microsoft SharePoint Enterprise Server (affected versions not specified)
Description A cross-site scripting issue exists due to inadequate protection of the web page structure. This could allow a remote attacker to perform cross-site scripting attacks by sending a specially crafted request to the vulnerable SharePoint server. The attacker could then run scripts in the security context of the current user, potentially reading unauthorized content, using the victim's identity to take actions on the SharePoint site, and injecting malicious content into the user's browser.
Recommendations For Microsoft SharePoint Server, update to a version that properly sanitizes web requests to prevent cross-site scripting attacks. For Microsoft SharePoint Enterprise Server, apply configuration changes to ensure specially crafted requests are handled correctly, preventing exploitation of the cross-site scripting issue. As a temporary workaround, consider restricting access to sensitive areas of the SharePoint site to minimize the risk of unauthorized actions being taken on behalf of users.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2020-02063
CVE-2020-0930

Affected Products

Sharepoint Server