description: An information disclosure vulnerability exists where certain modes of the search function in Microsoft SharePoint Server are vulnerable to cross-site search attacks (a variant of cross-site request forgery, CSRF).When users are simultaneously logged in to Microsoft SharePoint Server and visit a malicious web page, the attacker can, through standard browser functionality, induce the browser to invoke search queries as the logged in user, aka 'Microsoft SharePoint Information Disclosure Vulnerability'.
problem types: Information Disclosure
affected:
{
product: Microsoft SharePoint Enterprise Server
vendor: Microsoft
versions:
status: affected, version: 2016
}
{
product: Microsoft SharePoint Server
vendor: Microsoft
versions:
status: affected, version: 2019
}
{
product: Microsoft SharePoint Foundation
vendor: Microsoft
versions:
status: affected, version: 2013 Service Pack 1
}
