Technical impact
The vulnerability is an improper neutralization of input during web page generation, classified as cross‑site scripting. An authorized attacker can inject malicious content that appears legitimate, enabling spoofing across a network. This may allow the attacker to deceive users or request messages, compromising authenticity. The weakness is identified as CWE‑79.
Affected Systems
Affected systems include Microsoft SharePoint Server Subscription Edition. No specific version information is provided in the CNA data, so all deployed instances could potentially be affected.
Risk and Exploitability
The CVSS score of 4.6 indicates moderate severity. EPSS data is not available, and this vulnerability is not listed in the CISA KEV catalog. The attack vector requires an authorized attacker who has the ability to create or edit web content; with such privileges the attacker can embed malicious scripts that are rendered as part of normal SharePoint pages, leading to spoofing. Because exploitation depends on legitimate user actions, the likelihood is limited to environments where trusted users can modify page content.
