This vulnerability arises from improper neutralization of input when generating SharePoint web pages, allowing cross‑site scripting. An attacker who can inject such input can embed malicious JavaScript that will execute in the browsers of users who view the affected pages, leading to spoofing where users believe they are interacting with a legitimate SharePoint interface. The description does not indicate further impacts such as privilege escalation or data theft.

Microsoft Office SharePoint Server 2019 is affected. The vulnerability is reported for the 2019 edition of SharePoint Server, with no additional version qualifiers noted in the CNA data.

The CVSS score of 8.1 indicates high severity. Because the EPSS score is not available, the exploitation likelihood cannot be quantified, and the vulnerability is not listed in CISA's KEV catalog. Based on the description and the nature of XSS, the likely attack vector is client‑side web interaction; an attacker can exploit the flaw by inserting malicious input into SharePoint content or configuration that is then served to other users. Successful exploitation would give the attacker control over the rendered page, enabling spoofing and potentially further social‑engineering attacks.