CVE-2020-1456

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-1450, CVE-2020-1451.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Microsoft	Microsoft SharePoint Enterprise Server	2016; 2013 Service Pack 1
Microsoft	Microsoft SharePoint Server	2019; 2010 Service Pack 2

References

https://it-sec.de/ger/Aktuelles-Termine/it.sec-blog/it.sec-Research-Team-findet-unbekannte-Schwachstelle-in-Microsoft-Office-SharePointThird Party Advisory
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1456Patch, Vendor Advisory
https://slashcrypto.org/2021/01/15/CVE-2020-1456/Exploit, Third Party Advisory
https://it-sec.de/ger/Aktuelles-Termine/it.sec-blog/it.sec-Research-Team-findet-unbekannte-Schwachstelle-in-Microsoft-Office-SharePointThird Party Advisory
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1456Patch, Vendor Advisory
https://slashcrypto.org/2021/01/15/CVE-2020-1456/Exploit, Third Party Advisory
https://slashcrypto.org/2021/01/15/CVE-2020-1456/Exploit, Third Party Advisory

Timeline

Published: Jul 14, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-145604.2Vulnerability in the Oracle Hyperion BI+ product of Oracle Hyperion (component: UI and Visualization). The supported version that is affecte CVE-2020-145617.3Vulnerability in the Oracle Hospitality Reporting and Analytics product of Oracle Food and Beverage Applications (component: Installation). CVE-2020-145625.3Vulnerability in the Java SE product of Oracle Java SE (component: ImageIO). Supported versions that are affected are Java SE: 11.0.7 and 14 CVE-2020-145636.1Vulnerability in the Oracle Enterprise Communications Broker product of Oracle Communications Applications (component: WebGUI). Supported ve CVE-2020-145642.7Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Environment Mgmt Console). Supported version CVE-2020-145658.1Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: Security). Supported versions that are affecte CVE-2020-145664.3Vulnerability in the Primavera Portfolio Management product of Oracle Construction and Engineering (component: Web Access). Supported versio CVE-2020-145674.9Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are 5.7.29 CVE-2020-145684.9Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.20 and prior. Ea CVE-2020-145698.1Vulnerability in the Oracle FLEXCUBE Investor Servicing product of Oracle Financial Services Applications (component: Infrastructure). Suppo CVE-2020-14577.8A remote code execution vulnerability exists in the way that Microsoft Windows Codecs Library handles objects in memory, aka 'Microsoft Wind CVE-2020-145707.1Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: Mobile Service). Supported versions that are affect