The vulnerability is a server‑side request forgery that permits an attacker with valid credentials on Microsoft SharePoint to cause the server to initiate requests to arbitrary network locations, thereby disclosing internal or external information. The weakness, identified as CWE‑918, can lead to the unintended exposure of sensitive data over the network and compromise confidentiality but does not provide a pathway to remote code execution or system compromise.

Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, and Microsoft SharePoint Server Subscription Edition are affected. No specific patch version details are listed in the input; the impact applies to all installations of these products as described.

The CVSS score of 5.4 reflects moderate potential risk, while an EPSS of less than 1% indicates that active exploitation attempts are rare at this time. The vulnerability is not cataloged in the CISA KEV list. Because the exploit requires authenticated access, an attacker would need to be authorized or have compromised user credentials. If successful, the attacker could redirect SharePoint’s outbound traffic to malicious hosts and siphon sensitive data, but the likelihood of exploitation remains low under current threat conditions.