What happened
An vulnerability has been identified in Microsoft SharePoint Server Subscription Edition that allows for cross-site scripting (XSS). The flaw results from improper neutralisation of input during web page generation, which can enable an authorised attacker to perform spoofing over a network. The vulnerability arises when content delivered remotely is opened or visited by a user, requiring their interaction to trigger the exploit. Once exploited, an attacker could potentially manipulate the appearance of web content or perform other spoofing-based actions. The issue affects Microsoft SharePoint Server Subscription Edition (x64-based systems) versions from 16.0.0 up to, but not including, 16.0.20326.20190. A fix for this vulnerability has been issued by Microsoft and is available for deployment. The attack path involves delivery of malicious content that the victim opens or visits over the network. This does not involve exposed network services but relies on web content or files being delivered through email or browsing activities. Once the user interacts with the malicious content, the vulnerability can be exploited, making user awareness and content filtering critical mitigation steps. Who is affected The affected deployments are those running Microsoft SharePoint Server Subscription Edition (x64-based Systems) within the specified versions. It is important to note that exploitation requires user interaction, and the vulnerability can be exploited remotely through content delivered over the network. The severity of this vulnerability is rated as medium, reflecting the partial impact that can occur upon successful exploitation. Recommended actions
Apply the available patch from Microsoft to affected systems, as detailed in the official update guide linked in the references. Implement content filtering, blocking, or sandboxing of email and web content that may deliver untrusted or malicious content designed to trigger the vulnerability. Ensure procedures are in place for user awareness regarding the risks of opening files or visiting web pages from untrusted sources. Mitigate delivery and rendering of untrusted content through attack-surface reduction measures on software that opens such content.
