CVE-2020-1514: Microsoft Office SharePoint XSS Vulnerability
First published: Fri Sep 11 2020(Updated: )
<p>A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected SharePoint server.</p> <p>The attacker who successfully exploited the vulnerability could then perform cross-site scripting attacks on affected systems and run script in the security context of the current user. The attacks could allow the attacker to read content that the attacker is not authorized to read, use the victim's identity to take actions on the SharePoint site on behalf of the user, such as change permissions and delete content, and inject malicious content in the browser of the user.</p> <p>The security update addresses the vulnerability by helping to ensure that SharePoint Server properly sanitizes web requests.</p>
Credit: secure@microsoft.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Microsoft SharePoint Enterprise Server 2016 | =2016 | |
| Microsoft SharePoint Foundation 2013 | =2013-sp1 | |
| Microsoft SharePoint Server 2010 | =2019 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2020-1514?
CVE-2020-1514 has a severity rating of important as it affects authenticated users who could exploit the XSS vulnerability.
How do I fix CVE-2020-1514?
To fix CVE-2020-1514, apply the security updates provided by Microsoft for the affected SharePoint versions.
Which versions of SharePoint are affected by CVE-2020-1514?
CVE-2020-1514 affects Microsoft SharePoint Server 2019, SharePoint Enterprise Server 2016, and SharePoint Foundation 2013 SP1.
What type of vulnerability is CVE-2020-1514?
CVE-2020-1514 is classified as a cross-site scripting (XSS) vulnerability.
Can CVE-2020-1514 be exploited remotely?
CVE-2020-1514 can be exploited by authenticated attackers sending specially crafted web requests to an affected server.
- agent/first-publish-date
- agent/type
- agent/softwarecombine
- agent/description
- agent/title
- agent/severity
- agent/references
- agent/remedy
- agent/weakness
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- collector/nvd-index
- agent/author
- vendor/microsoft
- canonical/microsoft sharepoint enterprise server 2016
- version/microsoft sharepoint enterprise server 2016/2016
- canonical/microsoft sharepoint foundation 2013
- version/microsoft sharepoint foundation 2013/2013-sp1
- canonical/microsoft sharepoint server 2010
- version/microsoft sharepoint server 2010/2019