PT-2020-2194 · Microsoft · Sharepoint Server

Hph0Var

+1

·

Published

2020-04-14

·

Updated

2025-02-28

·

CVE-2020-0927

CVSS v3.1

5.4

Medium

VectorAV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions Microsoft SharePoint Server (affected versions not specified) Microsoft SharePoint Enterprise Server (affected versions not specified)
Description A cross-site scripting issue exists due to inadequate protection of the web page structure. This could allow a remote attacker to perform cross-site scripting attacks by sending a specially crafted request to the vulnerable SharePoint server. The attacker could then run scripts in the security context of the current user, potentially allowing them to read unauthorized content, use the victim's identity to take actions on the SharePoint site, and inject malicious content into the user's browser.
Recommendations For Microsoft SharePoint Server, update to a version that properly sanitizes web requests to prevent cross-site scripting attacks. For Microsoft SharePoint Enterprise Server, apply configuration changes to ensure that specially crafted requests are handled correctly to mitigate the risk of cross-site scripting attacks. As a temporary workaround, consider restricting access to sensitive areas of the SharePoint site to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2020-02098
CVE-2020-0927

Affected Products

Sharepoint Server