CVE-2020-1443: 
vulnerability analysis and mitigation

A spoofing vulnerability (CVE-2020-1443) exists in Microsoft SharePoint Server when it fails to properly sanitize specially crafted web requests to affected SharePoint servers. This vulnerability was disclosed and patched as part of Microsoft's July 2020 security updates (NVD, CVE).

The vulnerability has been assigned a CVSS v3.1 Base Score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. Under CVSS v2.0, it received a Base Score of 3.5 (Low) with the vector (AV:N/AC:M/Au:S/C:N/I:P/A:N). The vulnerability affects multiple versions of SharePoint, including SharePoint Enterprise Server 2016, SharePoint Foundation 2013 SP1, and SharePoint Server 2019 (NVD).

The vulnerability could allow an attacker to perform spoofing attacks against affected SharePoint servers, potentially compromising the integrity of web requests and responses. The CVSS scores indicate that the vulnerability has low to medium impact on confidentiality and integrity, with no impact on availability (NVD).

The vulnerability requires network access and low privileges to exploit, with no user interaction needed. The attack complexity is considered low under CVSS v3.1, indicating that the vulnerability is relatively straightforward to exploit under the right conditions (NVD).

Microsoft released security updates to address this vulnerability as part of the July 14, 2020 security updates. The fixes are available for SharePoint Enterprise Server 2016, SharePoint Foundation 2013 SP1, and SharePoint Server 2019 (Microsoft Support).