Description

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.6",
  "pubDate": "2026-08-11T17:18:51.057Z",
  "pubdate": "2026-08-11T17:18:51.057Z",
  "executiveSummary": "This vulnerability involves an improper neutralization of input during web page generation, specifically categorized as cross-site scripting (XSS), affecting Microsoft Office SharePoint.\nThe security flaw enables an authorized remote attacker to conduct spoofing attacks over a network.\nThe primary impact of successful exploitation includes the manipulation of web page content and potential unauthorized execution of malicious scripts within the context of a victim's session, leading to localized spoofing and session compromise.\nThe affected product is Microsoft Office SharePoint.\nRisk implications include the potential degradation of data integrity and user trust within the SharePoint environment, as malicious payloads can be rendered in the browser of interacting users.\nAttacker capabilities require network access and authorization to interact with the vulnerable SharePoint application.\nExploitation requirements necessitate that the attacker has the necessary authorization to input data that is subsequently improperly neutralized during web page generation by the application.",
  "technicalDetails": "The vulnerability resides within the web page generation mechanism of Microsoft Office SharePoint, where user-supplied input is inadequately sanitized or encoded before being reflected back to the client.\nThis root cause allows malicious input containing executable script blocks or HTML tags to be processed as legitimate content by the rendering browser.\nThe vulnerable component is the input processing and output encoding subsystem responsible for rendering dynamic web pages in SharePoint.\nExploitation occurs over the network vector and requires the attacker to be an authorized user capable of injecting crafted input into the application.\nThe step-by-step attack flow begins when the attacker crafts a malicious payload designed to exploit the cross-site scripting weakness.\nThe attacker submits this payload via an authorized channel or interface within Microsoft Office SharePoint where input handling lacks proper neutralization.\nThe application stores or directly reflects the unvalidated input, embedding it directly into the generated web page DOM without applying contextual output encoding.\nWhen a victim requests or views the affected web page, the browser receives the malicious payload and executes it within the security context of the user's session.\nPost-exploitation impact includes the execution of arbitrary scripts, potential defacement of the web interface, session hijacking, or localized spoofing capabilities, undermining the confidentiality and integrity of the application session."
}