This vulnerability arises from improper neutralization of user input when SharePoint generates web pages. The resulting cross‑site scripting flaw can be leveraged by an authorised attacker to inject malicious scripts or modify page content, creating a network‑based spoofing scenario where users are presented with forged information that appears legitimate.

The flaw applies to Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, and Microsoft SharePoint Server Subscription Edition. No specific version numbers are listed; the vulnerability exists in installations that have not received the latest security update for this defect.

The CVSS score of 4.6 indicates a moderate severity. EPSS is not available and the vulnerability is not listed in CISA’s KEV catalog, suggesting no confirmed public exploits. Exploitation requires authenticated access to create or edit SharePoint content, implying that the attack vector is internal or requires privileged credentials. With those conditions, the attacker could use the compromised site to present spoofed content to visitors.