CVE-2020-1451: 
vulnerability analysis and mitigation

A cross-site-scripting (XSS) vulnerability (CVE-2020-1451) was identified in Microsoft SharePoint Server where the server fails to properly sanitize specially crafted web requests. This vulnerability, also known as 'Microsoft Office SharePoint XSS Vulnerability', affects multiple versions of SharePoint including SharePoint Enterprise Server 2013 SP1, 2016, and SharePoint Server 2010 SP2 and 2019. The vulnerability was initially reported in November 2019 and publicly disclosed in July 2020 (MITRE CVE, NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). Under CVSS v2.0, it received a base score of 3.5 (Low) with the vector (AV:N/AC:M/Au:S/C:N/I:P/A:N) (NVD).

The vulnerability could allow an attacker to execute cross-site scripting attacks when SharePoint Server fails to properly sanitize web requests. This could potentially lead to unauthorized access to sensitive information and the ability to perform actions in the context of the affected user (NVD).

The vulnerability requires an attacker to have low privileges and user interaction for successful exploitation. The attack can be launched remotely over the network, making it accessible to network-based attackers (NVD).

Microsoft has released security updates to address this vulnerability as part of their July 2020 security updates. The fix is included in security update KB4484436 for SharePoint Enterprise Server 2016 and similar updates for other affected versions (Microsoft Support).