PT-2020-2477 · Microsoft · Sharepoint Server+1

Hph0Var

+1

·

Published

2020-05-12

·

Updated

2025-02-28

·

CVE-2020-1100

CVSS v3.1

5.4

Medium

VectorAV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions Microsoft SharePoint Server (affected versions not specified) Microsoft SharePoint Foundation (affected versions not specified) Microsoft SharePoint Enterprise Server (affected versions not specified)
Description The issue is related to a cross-site scripting (XSS) vulnerability. This vulnerability occurs when Microsoft SharePoint Server does not properly sanitize a specially crafted web request. An authenticated attacker could exploit this by sending a specially crafted request to an affected SharePoint server. Successful exploitation could allow the attacker to perform cross-site scripting attacks, read unauthorized content, use the victim's identity to take actions on the SharePoint site, and inject malicious content into the user's browser.
Recommendations For Microsoft SharePoint Server, consider restricting access to sensitive areas of the server until a fix is available. For Microsoft SharePoint Foundation, restrict the ability to send specially crafted requests to the server as a temporary mitigation measure. For Microsoft SharePoint Enterprise Server, as a temporary workaround, consider disabling any functionality that allows the execution of scripts in the context of the current user until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2020-02488
CVE-2020-1100

Affected Products

Sharepoint Server
Sharepoint Foundation