An information disclosure vulnerability exists where certain modes of the search function in Microsoft SharePoint Server are vulnerable to cross-site search attacks (a variant of cross-site request forgery, CSRF).
When users are simultaneously logged in to Microsoft SharePoint Server and visit a malicious web page, the attacker can, through standard browser functionality, induce the browser to invoke search queries as the logged in user. While the attacker can’t access the search results or documents as such, the attacker can determine whether the query did return results or not, and thus by issuing targeted queries discover facts about documents that are searchable for the logged-in user.
The security update addresses the vulnerability by running the search queries in a way that doesn’t expose them to this browser vulnerability.
When users are simultaneously logged in to Microsoft SharePoint Server and visit a malicious web page, the attacker can, through standard browser functionality, induce the browser to invoke search queries as the logged in user. While the attacker can’t access the search results or documents as such, the attacker can determine whether the query did return results or not, and thus by issuing targeted queries discover facts about documents that are searchable for the logged-in user.
The security update addresses the vulnerability by running the search queries in a way that doesn’t expose them to this browser vulnerability.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Microsoft | Microsoft SharePoint Enterprise Server 2016 | affected |
|
||||||
| Microsoft | Microsoft SharePoint Foundation 2013 Service Pack 1 | affected |
|
||||||
| Microsoft | Microsoft SharePoint Server 2019 | affected |
|
Configuration 1 [-]
|
No data.
No data.
Project Subscriptions
Advisories
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2020-11991 | An information disclosure vulnerability exists where certain modes of the search function in Microsoft SharePoint Server are vulnerable to cross-site search attacks (a variant of cross-site request forgery, CSRF).When users are simultaneously logged in to Microsoft SharePoint Server and visit a malicious web page, the attacker can, through standard browser functionality, induce the browser to invoke search queries as the logged in user, aka 'Microsoft SharePoint Information Disclosure Vulnerability'. |
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Wed, 19 Aug 2026 16:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | An information disclosure vulnerability exists where certain modes of the search function in Microsoft SharePoint Server are vulnerable to cross-site search attacks (a variant of cross-site request forgery, CSRF).When users are simultaneously logged in to Microsoft SharePoint Server and visit a malicious web page, the attacker can, through standard browser functionality, induce the browser to invoke search queries as the logged in user, aka 'Microsoft SharePoint Information Disclosure Vulnerability'. | An information disclosure vulnerability exists where certain modes of the search function in Microsoft SharePoint Server are vulnerable to cross-site search attacks (a variant of cross-site request forgery, CSRF). When users are simultaneously logged in to Microsoft SharePoint Server and visit a malicious web page, the attacker can, through standard browser functionality, induce the browser to invoke search queries as the logged in user. While the attacker can’t access the search results or documents as such, the attacker can determine whether the query did return results or not, and thus by issuing targeted queries discover facts about documents that are searchable for the logged-in user. The security update addresses the vulnerability by running the search queries in a way that doesn’t expose them to this browser vulnerability. |
| Title | Microsoft SharePoint Information Disclosure Vulnerability | |
| First Time appeared |
Microsoft sharepoint Foundation 2013
Microsoft sharepoint Server 2016 Microsoft sharepoint Server 2019 |
|
| CPEs | cpe:2.3:a:microsoft:sharepoint_foundation_2013:*:sp1:*:*:*:*:*:* cpe:2.3:a:microsoft:sharepoint_server_2016:*:*:*:*:enterprise:*:*:* cpe:2.3:a:microsoft:sharepoint_server_2019:*:*:*:*:*:*:*:* |
|
| Vendors & Products |
Microsoft sharepoint Foundation 2013
Microsoft sharepoint Server 2016 Microsoft sharepoint Server 2019 |
|
| References |
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: microsoft
Published:
Updated: 2026-08-19T16:34:01.958Z
Reserved: 2019-11-04T00:00:00.000Z
Link: CVE-2020-1103
Vulnrichment
No data.
NVD
Status : Modified
Published: 2020-05-21T23:15:14.477
Modified: 2026-08-19T17:17:17.527
Link: CVE-2020-1103
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses