CVE-2014-1754: XSS
First published: Wed May 14 2014(Updated: )
Cross-site scripting (XSS) vulnerability in Microsoft SharePoint Server 2013 Gold and SP1, SharePoint Foundation 2013 Gold and SP1, Office Web Apps Server 2013 Gold and SP1, and SharePoint Server 2013 Client Components SDK allows remote attackers to inject arbitrary web script or HTML via a crafted request, aka "SharePoint XSS Vulnerability."
Credit: secure@microsoft.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Microsoft Office Web Apps Server | =2013 | |
| Microsoft Office Web Apps Server | =2013-sp1 | |
| Microsoft SharePoint Foundation | =2013 | |
| Microsoft SharePoint Foundation | =2013-sp1 | |
| Microsoft SharePoint Server | =2013 | |
| Microsoft SharePoint Server | =2013-sp1 | |
| Microsoft SharePoint Server Client Components SDK | =2013 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2014-1754?
The severity of CVE-2014-1754 is considered medium due to its potential to allow remote attackers to execute scripts on affected systems.
How do I fix CVE-2014-1754?
To fix CVE-2014-1754, apply the latest security updates released by Microsoft for the affected software versions.
What software is affected by CVE-2014-1754?
CVE-2014-1754 affects Microsoft SharePoint Server 2013, SharePoint Foundation 2013, Office Web Apps Server 2013, and SharePoint Server 2013 Client Components SDK.
Can CVE-2014-1754 be exploited without user interaction?
Yes, CVE-2014-1754 can be exploited remotely by an attacker without requiring user interaction.
What are the potential consequences of an exploit of CVE-2014-1754?
Exploitation of CVE-2014-1754 could allow an attacker to inject arbitrary web scripts or HTML into a website viewed by users.
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/author
- agent/references
- agent/weakness
- agent/severity
- agent/description
- agent/event
- agent/first-publish-date
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/microsoft
- canonical/microsoft office web apps server
- version/microsoft office web apps server/2013
- version/microsoft office web apps server/2013-sp1
- canonical/microsoft sharepoint foundation
- version/microsoft sharepoint foundation/2013
- version/microsoft sharepoint foundation/2013-sp1
- canonical/microsoft sharepoint server
- version/microsoft sharepoint server/2013
- version/microsoft sharepoint server/2013-sp1
- canonical/microsoft sharepoint server client components sdk
- version/microsoft sharepoint server client components sdk/2013