Improper neutralization of user input in Microsoft SharePoint web page generation permits an authenticated attacker to inject malicious script, leading to spoofing of the site interface. The attacker can modify or fabricate elements of a SharePoint page, potentially deceiving users into trusting false content or credentials. This affects confidentiality and integrity of the displayed data and can undermine user trust in the platform.

The vulnerability impacts Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, and Microsoft SharePoint Server Subscription Edition. Specific patched versions are not listed in the data, so any installation of these products that has not applied the latest security update is exposed.

The CVSS score of 7.3 indicates high severity. The vulnerability is not listed in CISA’s KEV catalog, suggesting no publicly confirmed exploits at the time of reporting. The likely attack vector requires an authorized user with the ability to input content into SharePoint, implying that if credentials are compromised or users are careless with permissions, the attacker could exploit the flaw easily.