CVE-2020-1580: Microsoft Office SharePoint XSS Vulnerability
First published: Mon Aug 17 2020(Updated: )
A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-1573.
Credit: secure@microsoft.com secure@microsoft.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Microsoft SharePoint Enterprise Server | =2013-sp1 | |
| Microsoft SharePoint Enterprise Server | =2016 | |
| Microsoft SharePoint Foundation | =2013-sp1 | |
| Microsoft SharePoint Server | =2010-sp2 | |
| Microsoft SharePoint Server | =2019 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is CVE-2020-1580?
CVE-2020-1580 is a cross-site-scripting (XSS) vulnerability in Microsoft SharePoint Server that occurs when specially crafted web requests are not properly sanitized.
How does the CVE-2020-1580 vulnerability affect Microsoft SharePoint Server?
The CVE-2020-1580 vulnerability affects various versions of Microsoft SharePoint Server, including 2013 SP1, 2016, and 2019, as well as SharePoint Foundation 2013 SP1 and SharePoint Server 2010 SP2.
What is the severity of CVE-2020-1580?
The severity of CVE-2020-1580 is medium with a CVSS score of 5.4.
How can I fix the CVE-2020-1580 vulnerability?
To fix the CVE-2020-1580 vulnerability, it is recommended to apply the latest security updates provided by Microsoft for the affected SharePoint Server versions.
Where can I find more information about CVE-2020-1580?
You can find more information about CVE-2020-1580 on the Microsoft Security Response Center's advisory page: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1580
- collector/nvd-index
- agent/author
- agent/type
- agent/event
- agent/description
- agent/softwarecombine
- agent/last-modified-date
- agent/first-publish-date
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/weakness
- agent/references
- agent/title
- agent/remedy
- agent/severity
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/microsoft
- canonical/microsoft sharepoint enterprise server
- version/microsoft sharepoint enterprise server/2013-sp1
- version/microsoft sharepoint enterprise server/2016
- canonical/microsoft sharepoint foundation
- version/microsoft sharepoint foundation/2013-sp1
- canonical/microsoft sharepoint server
- version/microsoft sharepoint server/2010-sp2
- version/microsoft sharepoint server/2019