Description

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.6",
  "pubDate": "2026-08-11T17:18:52.900Z",
  "pubdate": "2026-08-11T17:18:52.900Z",
  "executiveSummary": "This vulnerability is classified as an improper neutralization of input during web page generation, commonly known as cross-site scripting (XSS), affecting Microsoft Office SharePoint.\nThe primary impact of this security flaw is spoofing, which allows an attacker to manipulate the visual presentation of web pages or execute unauthorized scripts within the context of a victim's browser session.\nThe affected product is Microsoft Office SharePoint, and the risk implications include the potential compromise of user session integrity, unauthorized interaction with the application on behalf of the user, and deceptive content injection.\nExploitation requires an authorized attacker with network access to the target SharePoint deployment.\nThe attacker must leverage their authorized access to inject crafted input that the application fails to properly sanitize or neutralize during dynamic web page generation.\nOnce the malicious input is rendered by the browser of another user, the attack payload executes, leading to the intended spoofing condition.\nOverall, the vulnerability undermines trust in the web application's interface and poses a significant risk to organizational data integrity and user session security if left unaddressed.",
  "technicalDetails": "The root cause of the vulnerability lies in the improper neutralization of user-supplied input prior to its inclusion in dynamically generated web pages by Microsoft Office SharePoint.\nWhen input containing malicious scripts or markup is processed by the web application without adequate sanitization, encoding, or validation, the resulting output interprets the input as executable code rather than plain text.\nThe vulnerable component involves the web page rendering and input handling mechanisms within SharePoint that process user input for display.\nExploitation occurs over a network vector and requires the attacker to possess authorization within the SharePoint environment to supply or inject the malicious input.\nThe attack flow proceeds in a step-by-step manner: first, the authorized attacker crafts a malicious payload containing specially formatted script or markup designed to spoof legitimate interface elements or perform unauthorized actions.\nSecond, the attacker submits this payload to the SharePoint application through standard data input vectors where input filtering is insufficient.\nThird, the application stores or reflects this input, incorporating it directly into the Document Object Model (DOM) of generated web pages without proper contextual output encoding.\nFourth, when a targeted user navigates to the affected page, the browser receives the unmitigated payload and executes the embedded script within the security context of the user's active session.\nPost-exploitation impact includes the ability to spoof interface components, mislead users regarding application state or data authenticity, and potentially interact with the SharePoint environment using the victim's delegated privileges.\nThe vulnerability highlights a failure in enforcing strict separation between application code and user-controlled data during the rendering lifecycle."
}