Product:
Office SharePoint
Summary
Improper neutralization of input during web page generation allows an authorized attacker to perform spoofing over a network. This vulnerability can lead to cross-site scripting attacks, which may compromise user data. Attackers can exploit this flaw if they have the necessary privileges and user interaction is required.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 4.6 | CVE-2026-20945 |
Exploitation
To exploit this vulnerability, an attacker must have authorized access to the affected system. They can craft a malicious input that is improperly handled by the web page generation process. When a user interacts with the compromised page, the attacker’s script can execute in the user’s browser, potentially leading to data theft or further attacks.
Affected Products
- Office SharePoint: A web-based collaboration platform that allows users to create and manage content.
Mitigation
To mitigate this vulnerability, it is recommended to apply the latest security updates provided by Microsoft. Additionally, users should be educated on the risks of interacting with untrusted content and the importance of maintaining secure access controls.