Cross-site scripting in Microsoft SharePoint Server
Priority LOW 28CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-79.
Summary
A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka "Microsoft Office SharePoint XSS Vulnerability." This affects Microsoft SharePoint Server, Microsoft SharePoint, Microsoft Business Productivity Servers. This CVE ID is unique from CVE-2019-0556, CVE-2019-0557.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01996 80th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Microsoft | Microsoft SharePoint Server | 2019 | — | No fix listed | CNA |
| Microsoft | Microsoft SharePoint | Enterprise Server 2013 Service Pack 1; Enterprise Server 2016 | — | No fix listed | CNA |
| Microsoft | Microsoft Business Productivity Servers | 2010 Service Pack 2 | — | No fix listed | CNA |
- Microsoft SharePoint Server VendorMicrosoft Affected 2019 Fixed in — No fix listed CNA
- Microsoft SharePoint VendorMicrosoft Affected Enterprise Server 2013 Service Pack 1; Enterprise Server 2016 Fixed in — No fix listed CNA
- Microsoft Business Productivity Servers VendorMicrosoft Affected 2010 Service Pack 2 Fixed in — No fix listed CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:microsoft:business_productivity_servers:2010:sp2:*:*:*:*:*:* | 2010 sp2 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:sharepoint_server:2013:sp1:*:*:enterprise:*:*:* | 2013 sp1 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:sharepoint_server:2016:*:*:*:enterprise:*:*:* | 2016 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:* | 2019 | Vulnerable | Microsoft |
- cpe:2.3:a:microsoft:business_productivity_servers:2010:sp2:*:*:*:*:*:* Versions 2010 sp2 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:sharepoint_server:2013:sp1:*:*:enterprise:*:*:* Versions 2013 sp1 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:sharepoint_server:2016:*:*:*:enterprise:*:*:* Versions 2016 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:* Versions 2019 Vulnerable ·Microsoft
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2019-0558
- 2026-10-03 Alias added: GHSA-rvmf-46hh-x3rp
More Microsoft Business Productivity Servers vulnerabilities
- TI-2021-08646 Microsoft SharePoint Server Remote Code Execution Vulnerability CVSS 3.1HIGH 8.8
- TI-2017-00221 Memory corruption in Microsoft Office 2007 SP2 and SP3, Microsoft Office 2010 SP2… CVSS 3.0HIGH 7.8
- TI-2020-00901 Unrestricted file upload in Microsoft SharePoint Foundation CVSS 3.1HIGH 8.8
- TI-2020-00770 Cross-site scripting in Microsoft SharePoint Enterprise Server CVSS 3.1MEDIUM 5.4
Sources
- CVE-2019-0558 · CVE Program
- CVE-2019-0558 · NVD
- FIRST EPSS
- GHSA-rvmf-46hh-x3rp · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences