CVE-2020-1101
MediumCVSS 5.4Exploitation Probability (EPSS)
Elevated risk74th percentile - higher than 74% of all known CVEs
Summary
A cross-site-scripting (XSS) vulnerability in Microsoft SharePoint Server due to improper sanitization of specially crafted web requests. An authenticated attacker can send a crafted request, and upon exploitation, perform XSS attacks, read unauthorized content, act on behalf of the user (e.g., change permissions, delete content), and inject malicious content into the user's browser.
Risk Assessment
An attacker can gain unauthorized access to content, manipulate permissions, and inject malicious content, posing a serious threat to data integrity and confidentiality.
Recommendation
Install the security update that ensures proper sanitization of web requests in SharePoint Server.
Other vulnerabilities in Microsoft SharePoint Server
See all- CVE-2017-8569High
Microsoft SharePoint Server has an elevation of privilege vulnerability due to improper sanitization of a specially crafted web request to an affected SharePoint server.
- CVE-2025-53770CriticalActively exploited
Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network. Microsoft is aware of an exploit in the wild and is preparing an update.
- CVE-2023-33160High
A vulnerability in Microsoft SharePoint Server allows remote code execution by an attacker. Exploiting this flaw could lead to system takeover.
- CVE-2021-34467High
Vulnerability in Microsoft SharePoint Server allows remote code execution. An attacker could exploit it to run arbitrary code on the SharePoint server.
- CVE-2021-34519Medium
Information disclosure vulnerability in Microsoft SharePoint Server. An attacker could exploit this flaw to gain access to information that should be protected.
- CVE-2021-27076High
Remote Code Execution vulnerability in Microsoft SharePoint Server. Details are not provided in the description.
- CVE-2020-1069High
A remote code execution vulnerability in Microsoft SharePoint Server due to failure to properly identify and filter unsafe ASP.Net web controls. An authenticated attacker could exploit it by creating a specially crafted page. The update corrects how SharePoint Server handles processing of created content.
- CVE-2023-36894Medium
A vulnerability in Microsoft SharePoint Server allows for information disclosure, potentially leading to unauthorized access to sensitive data.
- CVE-2023-36892High
A vulnerability in Microsoft SharePoint Server allows for spoofing, which may lead to unauthorized access to user data. An attacker can exploit this flaw to impersonate a trusted source.
- CVE-2023-36891High
A vulnerability in Microsoft SharePoint Server allows for spoofing, potentially leading to unauthorized access to user data. An attacker could exploit this flaw to impersonate a trusted source.
Original NVD description (English source)
A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected SharePoint server. The attacker who successfully exploited the vulnerability could then perform cross-site scripting attacks on affected systems and run script in the security context of the current user. The attacks could allow the attacker to read content that the attacker is not authorized to read, use the victim's identity to take actions on the SharePoint site on behalf of the user, such as change permissions and delete content, and inject malicious content in the browser of the user. The security update addresses the vulnerability by helping to ensure that SharePoint Server properly sanitizes web requests.