PT-2020-2210 · Microsoft · Sharepoint Server

Published

2020-04-14

·

Updated

2025-02-28

·

CVE-2020-0973

CVSS v3.1

5.4

Medium

VectorAV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions Microsoft SharePoint Server (affected versions not specified) Microsoft SharePoint Enterprise Server (affected versions not specified)
Description The issue is related to the failure to protect the web page structure, allowing for cross-site scripting attacks. An attacker could exploit this by sending a specially crafted request to the vulnerable SharePoint server, potentially leading to unauthorized actions such as reading restricted content, changing permissions, deleting content, and injecting malicious content into the user's browser.
Recommendations For Microsoft SharePoint Server, update to a version that includes proper sanitization of web requests to prevent cross-site scripting attacks. For Microsoft SharePoint Enterprise Server, apply configuration changes to restrict access to vulnerable components until a patch is available. As a temporary workaround, consider restricting access to the SharePoint site to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2020-02125
CVE-2020-0973

Affected Products

Sharepoint Server