CVE-2020-1183: 
vulnerability analysis and mitigation

A cross-site-scripting (XSS) vulnerability exists in Microsoft SharePoint Server when it fails to properly sanitize specially crafted web requests to affected SharePoint servers. This vulnerability was assigned CVE-2020-1183 and was disclosed in June 2020 (CVE Mitre, NVD).

The vulnerability is classified as a Cross-Site Scripting (CWE-79) issue. According to the National Vulnerability Database, it received a CVSS v3.1 Base Score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, indicating that it requires network access, low attack complexity, low privileges, and user interaction (NVD).

If successfully exploited, this vulnerability could allow an attacker to execute cross-site scripting attacks against users of affected SharePoint servers. The attack could potentially lead to unauthorized disclosure of information or elevation of privilege within the SharePoint environment (NVD).

The vulnerability requires an attacker to craft a special web request to the affected SharePoint server. The attack requires low complexity and low privileges but does need user interaction to be successful (NVD).

Microsoft released security updates to address this vulnerability as part of their June 2020 security updates. The fix was included in security update KB4484402 for SharePoint Enterprise Server 2016. Organizations are advised to apply these security updates to protect against this vulnerability (Microsoft Support).