TI-2019-00767 Aliases CVE-2019-1033 GHSA-gp38-6cc3-gxr4

Microsoft Office SharePoint XSS Vulnerability

LOW 28CWE-79Published 2019-06-12 · Updated 2025-05-20

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected SharePoint server. The attacker who successfully exploited the vulnerability could then perform cross-site scripting attacks on affected systems and run script in the security context of the current user. The attacks could allow the attacker to read content that the attacker is not authorized to read, use the victim's identity to take actions on the SharePoint site on behalf of the user, such as change permissions and delete content, and inject malicious content in the browser of the user. The security update addresses the vulnerability by helping to ensure that SharePoint Server properly sanitizes web requests.

Why it matters now

EPSS 0.01662 76th percentileScored 2026-11-07

Fix Fixed Microsoft SharePoint Enterprise Server 2016 (Microsoft): publicationMicrosoft SharePoint Server 2019 (Microsoft): publication+2 more products

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Microsoft	Microsoft SharePoint Enterprise Server 2016	16.0.0 to before publication	publication	Patch available	CNA
Microsoft	Microsoft SharePoint Server 2019	16.0.0 to before publication	publication	Patch available	CNA
Microsoft	Microsoft Project Server 2010 Service Pack 2	13.0.0.0 to before publication	publication	Patch available	CNA
Microsoft	Microsoft SharePoint Foundation 2013 Service Pack 1	15.0.0 to before publication	publication	Patch available	CNA

Microsoft SharePoint Enterprise Server 2016 VendorMicrosoft Affected 16.0.0 to before publication Fixed in publication Patch available CNA
Microsoft SharePoint Server 2019 VendorMicrosoft Affected 16.0.0 to before publication Fixed in publication Patch available CNA
Microsoft Project Server 2010 Service Pack 2 VendorMicrosoft Affected 13.0.0.0 to before publication Fixed in publication Patch available CNA
Microsoft SharePoint Foundation 2013 Service Pack 1 VendorMicrosoft Affected 15.0.0 to before publication Fixed in publication Patch available CNA

CPE configurations NVD · 4

CPE	Versions	Role	Vendor
cpe:2.3:a:microsoft:project_server:2010:sp2::::::	2010 sp2	Vulnerable	Microsoft
cpe:2.3:a:microsoft:sharepoint_enterprise_server:2016:::::::*	2016	Vulnerable	Microsoft
cpe:2.3:a:microsoft:sharepoint_foundation:2013:sp1::::::	2013 sp1	Vulnerable	Microsoft
cpe:2.3:a:microsoft:sharepoint_server:2019:::::::*	2019	Vulnerable	Microsoft

cpe:2.3:a:microsoft:project_server:2010:sp2:*:*:*:*:*:* Versions 2010 sp2 Vulnerable ·Microsoft
cpe:2.3:a:microsoft:sharepoint_enterprise_server:2016:*:*:*:*:*:*:* Versions 2016 Vulnerable ·Microsoft
cpe:2.3:a:microsoft:sharepoint_foundation:2013:sp1:*:*:*:*:*:* Versions 2013 sp1 Vulnerable ·Microsoft
cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:* Versions 2019 Vulnerable ·Microsoft

Remediation

Fix · CNA Microsoft SharePoint Enterprise Server 2016 (Microsoft) Fixed in publication
Fix · CNA Microsoft SharePoint Server 2019 (Microsoft) Fixed in publication
Fix · CNA Microsoft Project Server 2010 Service Pack 2 (Microsoft) Fixed in publication
Fix · CNA Microsoft SharePoint Foundation 2013 Service Pack 1 (Microsoft) Fixed in publication

Timeline

2026-10-02 Threatist record created from CVE-2019-1033
2026-10-03 Alias added: GHSA-gp38-6cc3-gxr4

References

Patch 1

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1033

Advisory 1

Microsoft Office SharePoint XSS Vulnerability

TI-2018-05989 Code injection in Microsoft .NET Framework CVSS 3.0HIGH 8.1
TI-2009-00094 Microsoft Project 2000 SR1 and 2002 SP1, and Office Project 2003 SP3, does not properly… CVSS 2.0HIGH 9.3
TI-2015-02200 Microsoft Access 2007 SP3, Excel 2007 SP3, InfoPath 2007 SP3, OneNote 2007 SP3… CVSS 2.0HIGH 9.3
TI-2014-00243 Microsoft Windows SharePoint Services 3.0 SP3; SharePoint Server 2007 SP3, 2010 SP1 and… CVSS 2.0HIGH 9.0
TI-2017-00256 Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2016, Office Online… CVSS 3.0HIGH 7.8
TI-2006-06361 projectserver/logon/pdsrequest.asp in Microsoft Project Server 2003 allows remote… CVSS 2.0MEDIUM 6.5

See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences