CVE-2020-1514: 
vulnerability analysis and mitigation

A cross-site-scripting (XSS) vulnerability (CVE-2020-1514) exists in Microsoft SharePoint Server when it fails to properly sanitize specially crafted web requests. The vulnerability was disclosed and patched as part of Microsoft's September 2020 security updates (NVD). The vulnerability affects multiple versions of SharePoint, including SharePoint Enterprise Server 2016, SharePoint Foundation 2013 SP1, and SharePoint Server 2019.

The vulnerability has been assigned a CVSS v3.1 base score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. The vulnerability occurs when SharePoint Server fails to properly sanitize specially crafted web requests to an affected SharePoint server. The security context of the current user can be compromised through cross-site scripting attacks on affected systems (NVD).

If successfully exploited, an attacker could perform cross-site scripting attacks on affected systems and execute scripts in the security context of the current user. This could allow the attacker to read unauthorized content, use the victim's identity to take actions on the SharePoint site (such as changing permissions and deleting content), and inject malicious content in the user's browser (NVD).

The vulnerability requires an authenticated attacker to send a specially crafted request to an affected SharePoint server. The attack requires user interaction, as indicated by the CVSS metrics (NVD).

Microsoft addressed this vulnerability by releasing security updates that help ensure SharePoint Server properly sanitizes web requests. The fix was included in the September 8, 2020 security updates. Organizations should apply the security update KB4484505 for SharePoint Server 2019, KB4484506 for SharePoint Server 2016, or the appropriate update for their SharePoint version (Microsoft Support).