The vulnerability is a cross‑site scripting flaw that occurs when SharePoint does not properly neutralize input during web page generation. This flaw can be abused by an authenticated attacker to inject malicious scripts that cause the server to present a forged page to other users, effectively enabling user or session spoofing. The impact is therefore the ability to impersonate or misrepresent users or content, potentially undermining trust in the system's authenticity.

Microsoft SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition are affected. No specific version numbers are listed but all builds of these products are included.

The CVSS score of 4.6 indicates low overall severity. Exploit probability data is not available, and the vulnerability is not listed in CISA's KEV catalog. The attack likely requires the attacker to have legitimate credentials or authorized access to the SharePoint environment, after which they can inject malicious input into a page. No known publicly available exploits are reported at the time of this analysis.