CVE-2020-1500: 
vulnerability analysis and mitigation

A spoofing vulnerability (CVE-2020-1500) was identified in Microsoft SharePoint Server that affects how the server sanitizes specially crafted web requests. The vulnerability was disclosed and patched as part of Microsoft's August 2020 security updates (Microsoft Advisory). The affected systems include SharePoint Enterprise Server 2013 SP1, SharePoint Enterprise Server 2016, SharePoint Server 2010 SP2, and SharePoint Server 2019 (MITRE CVE).

The vulnerability exists due to improper sanitization of specially crafted web requests to affected SharePoint servers. The issue requires authentication for exploitation, meaning an attacker would need valid credentials to attempt exploitation. The vulnerability received a CVSS v3.1 base score of 5.4 (Medium) with a vector string of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N (NVD).

If successfully exploited, the vulnerability allows an attacker to perform cross-site scripting attacks on affected systems and execute scripts in the security context of the current user. This could enable the attacker to read unauthorized content, use the victim's identity to take actions on the SharePoint site (such as changing permissions and deleting content), and inject malicious content into the user's browser (MITRE CVE).

The vulnerability requires authentication for exploitation, meaning an attacker must have valid credentials to attempt exploitation. The attack can be performed by sending a specially crafted request to an affected SharePoint server (MITRE CVE).

Microsoft addressed the vulnerability by improving how SharePoint Server sanitizes web requests through a security update released on August 11, 2020. Users are advised to install the security update KB4484473 for SharePoint Enterprise Server 2016 or the appropriate update for their SharePoint version (Microsoft Support).