Read the docs
TI-2018-05970 Aliases CVE-2018-8254GHSA-wq96-r46v-f46v

Cross-site scripting in Microsoft Project Server

Priority LOW 30CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka "Microsoft SharePoint Elevation of Privilege Vulnerability." This affects Microsoft Project Server, Microsoft SharePoint. This CVE ID is unique from CVE-2018-8252.

Why it matters now

EPSS 0.02999 87th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
MicrosoftMicrosoft Project Server2010 Service Pack 2—No fix listedCNA
MicrosoftMicrosoft SharePointEnterprise Server 2016; Foundation 2013 Service Pack 1—No fix listedCNA
  • Microsoft Project Server VendorMicrosoft Affected 2010 Service Pack 2 Fixed in — No fix listed CNA
  • Microsoft SharePoint VendorMicrosoft Affected Enterprise Server 2016; Foundation 2013 Service Pack 1 Fixed in — No fix listed CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:microsoft:project_server:2010:sp2:*:*:*:*:*:*2010 sp2VulnerableMicrosoft
cpe:2.3:a:microsoft:sharepoint_foundation:2013:sp1:*:*:*:*:*:*2013 sp1VulnerableMicrosoft
cpe:2.3:a:microsoft:sharepoint_server:2016:*:*:*:*:*:*:*2016VulnerableMicrosoft
  • cpe:2.3:a:microsoft:project_server:2010:sp2:*:*:*:*:*:* Versions 2010 sp2 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:sharepoint_foundation:2013:sp1:*:*:*:*:*:* Versions 2013 sp1 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:sharepoint_server:2016:*:*:*:*:*:*:* Versions 2016 Vulnerable ·Microsoft

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-8254
  2. 2026-10-03 Alias added: GHSA-wq96-r46v-f46v

References

Patch 1

  • TI-2018-05989 Code injection in Microsoft .NET Framework CVSS 3.0HIGH 8.1
  • TI-2009-00094 Microsoft Project 2000 SR1 and 2002 SP1, and Office Project 2003 SP3, does not properly… CVSS 2.0HIGH 9.3
  • TI-2015-02200 Microsoft Access 2007 SP3, Excel 2007 SP3, InfoPath 2007 SP3, OneNote 2007 SP3… CVSS 2.0HIGH 9.3
  • TI-2014-00243 Microsoft Windows SharePoint Services 3.0 SP3; SharePoint Server 2007 SP3, 2010 SP1 and… CVSS 2.0HIGH 9.0
  • TI-2017-00256 Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2016, Office Online… CVSS 3.0HIGH 7.8
  • TI-2006-06361 projectserver/logon/pdsrequest.asp in Microsoft Project Server 2003 allows remote… CVSS 2.0MEDIUM 6.5
See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences