CVE-2020-1454: 
vulnerability analysis and mitigation

This vulnerability (CVE-2020-1454) is a Reflective XSS vulnerability in Microsoft SharePoint Server that was disclosed in July 2020. The vulnerability occurs when SharePoint Server does not properly sanitize specially crafted requests to an affected SharePoint server. It affects Microsoft SharePoint Enterprise Server 2016 and SharePoint Server 2019 (NVD, Microsoft Support).

The vulnerability is classified as a Cross-site Scripting (XSS) issue, specifically of the reflective type (CWE-79). It has been assigned a CVSS v3.1 base score of 5.4 (Medium) with the following vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. This indicates that the vulnerability requires network access, low attack complexity, low privileges, and user interaction to exploit (NVD).

If successfully exploited, this vulnerability could allow an authenticated attacker to execute cross-site scripting attacks against users who access the affected SharePoint server. The attacker could potentially execute arbitrary scripts in the context of the user's session, leading to disclosure of sensitive information or unauthorized actions (NVD).

The vulnerability requires an authenticated attacker to send a specially crafted request to an affected SharePoint server. The attack requires user interaction and low privileges to execute (NVD).

Microsoft has released security updates to address this vulnerability. Users should install the security update KB4484453 for SharePoint Server 2019 or KB4484436 for SharePoint Enterprise Server 2016 to protect against this vulnerability (Microsoft Support).