Description

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.6",
  "pubDate": "2026-08-11T17:18:36.910Z",
  "pubdate": "2026-08-11T17:18:36.910Z",
  "executiveSummary": "A cross-site scripting (XSS) vulnerability exists within Microsoft Office SharePoint, arising from the improper neutralization of user-supplied input during web page generation. This security flaw enables an authorized threat actor to execute arbitrary script code within the context of a victim's browser session over a network connection.\nThe primary impact of this vulnerability is spoofing, allowing an attacker to manipulate the rendered content of SharePoint web pages, potentially leading to unauthorized actions performed on behalf of the user, session hijacking, or the disclosure of sensitive information accessible within the application context.\nAffected systems encompass Microsoft Office SharePoint deployments where input sanitization fails during dynamic web page construction. The risk implication is moderate to high, depending on the privileges of the targeted user interacting with the malicious payload.\nTo successfully execute an attack, the adversary requires authorized access to the network and the ability to inject crafted input into the SharePoint application, which is subsequently rendered to other users or the attacker themselves depending on the specific injection vector (stored versus reflected XSS). Exploitation relies on the target application failing to properly encode or sanitize data before embedding it into the Document Object Model (DOM).",
  "technicalDetails": "The root cause of the vulnerability is the failure of Microsoft Office SharePoint to properly neutralize user-supplied input prior to incorporating it into dynamically generated web pages. This lack of robust input validation and output encoding allows malicious scripts—typically JavaScript or HTML—to be injected into the application data stream.\nThe vulnerable component resides within the web application interface and rendering engine of Microsoft Office SharePoint, which processes and displays user-submitted or manipulated data. Because the application fails to sanitize special characters (such as angle brackets, quotes, and event handlers), the injected payload is interpreted as executable code by the victim's web browser rather than inert text.\nThe attack flow begins when an authorized attacker crafts a malicious input string containing executable script payloads. The attacker introduces this payload into the SharePoint application over the network, leveraging input vectors such as form fields, URL parameters, or collaborative data stores. When the SharePoint server generates the HTML response containing the unsanitized input, it transmits the payload back to the client browser.\nUpon receiving the HTTP response, the victim's browser parses the HTML and executes the embedded script within the security context of the vulnerable SharePoint origin. Because the script executes in the user's browser, it inherits the user's session privileges, enabling the attacker to perform spoofing attacks, manipulate the Document Object Model, capture session tokens, or induce unauthorized actions.\nExploitation requires network access and authorization within the SharePoint environment, alongside the ability to supply or store malicious input. Post-exploitation impact includes unauthorized modification of the user interface (spoofing), potential compromise of user sessions, and further interaction with the SharePoint application leveraging the victim's authenticated privileges."
}