Microsoft Office Project Server Spoofing Vulnerability

In plain English

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office Project Server allows an authorized attacker to perform spoofing over a network. Affected products named by the advisory: Microsoft SharePoint Enterprise Server 2016; Microsoft SharePoint Server 2019; Microsoft SharePoint Server Subscription Edition. Cross-site scripting can run attacker-controlled script in a victim's browser within the affected application's trust boundary.

Vulnerable items

• Microsoft SharePoint Enterprise Server 2016 — Microsoft SharePoint Enterprise Server 2016 is a Microsoft Server server component identified as affected by the official advisory.
• Microsoft SharePoint Server 2019 — Microsoft SharePoint Server 2019 is a Microsoft Server server component identified as affected by the official advisory.
• Microsoft SharePoint Server Subscription Edition — Microsoft SharePoint Server Subscription Edition is a Microsoft Server server component identified as affected by the official advisory.

Recommended action

Primary action: update to a vendor-listed fixed release: 16.0.5556.1005, 16.0.10417.20153, 16.0.19725.20384.