Description

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-08-11T17:19:12.810Z",
  "pubdate": "2026-08-11T17:19:12.810Z",
  "executiveSummary": "This vulnerability involves an improper neutralization of input during web page generation, specifically classified as a cross-site scripting flaw within Microsoft Office SharePoint.\nThe security defect allows an authenticated attacker to execute arbitrary scripts in the context of another user's session over a network, ultimately leading to an elevation of privileges.\nThe affected product is Microsoft Office SharePoint.\nThe risk implications are significant, as successful exploitation enables unauthorized actors to bypass security controls, manipulate web page content, and potentially compromise sensitive data or administrative functions depending on the targeted user session.\nThe attacker must possess authorized network access to the target SharePoint environment and the ability to inject malicious input that is improperly handled during dynamic web page generation.\nExploitation requirements include network connectivity and the capability to supply crafted input payloads that the vulnerable application fails to sanitize or encode adequately before rendering them in the victim's browser.",
  "technicalDetails": "The root cause of this vulnerability is the failure of Microsoft Office SharePoint to properly sanitize, neutralize, or encode user-supplied input prior to reflecting or rendering it within dynamically generated web pages.\nThis lack of rigorous input validation and output encoding enables stored or reflected cross-site scripting (XSS) conditions.\nThe vulnerable component resides within the web application generation and rendering engine of Microsoft Office SharePoint, which processes and outputs user input to client browsers without adequate context-aware escaping.\nRegarding authentication and privilege requirements, the attack vector requires the adversary to be an authorized user within the network boundary, possessing the capability to submit crafted input vectors to the application.\nNetwork exposure is defined by accessibility to the Microsoft Office SharePoint service over the network interface.\nThe attack flow proceeds as follows: First, the authorized attacker crafts a malicious payload containing executable script content, such as JavaScript, designed to interact with the Document Object Model or execute privileged actions.\nSecond, the attacker injects this payload into the application via parameters or data fields that suffer from improper neutralization during web page generation.\nThird, when a victim user accesses the affected SharePoint page, the application embeds the unescaped malicious payload directly into the Hypertext Markup Language response.\nFourth, the victim's browser parses the HTTP response and executes the script within the security context of the victim's session.\nPayload behavior involves executing arbitrary client-side code within the trust domain of the application, allowing the script to inherit the user's session permissions.\nPost-exploitation impact includes privilege elevation, session hijacking, unauthorized access to sensitive documents, and the execution of administrative actions on behalf of the compromised user, effectively undermining the confidentiality and integrity of the SharePoint environment."
}