CVE-2019-1262

🗓️ 11 Sep 2019 21:24:59Reported by microsoftType

cve🔗 web.nvd.nist.gov👁 185 Views🌐 WEB

Microsoft SharePoint Server XSS Vulnerabilit

Reporter	Title	Published	Views	Family All 22
0day.today	Microsoft SharePoint 2013 SP1 - (DestinationFolder) Persistant Cross-Site Scripting Vulnerability	25 Sep 201900:00	–	zdt
BDU FSTEC	The vulnerability of Microsoft SharePoint Foundation software, related to the lack of measures for cleaning input data, allows a perpetrator to carry out cross-site scripting attacks.	13 Sep 201900:00	–	bdu_fstec
CNVD	Microsoft SharePoint Cross-Site Scripting Vulnerability (CNVD-2019-31853)	12 Sep 201900:00	–	cnvd
Check Point Advisories	Microsoft SharePoint DestinationFolder Cross-site Scripting (CVE-2019-1262)	22 Dec 201900:00	–	checkpoint_advisories
Cvelist	CVE-2019-1262	11 Sep 201921:24	–	cvelist
Exploit DB	Microsoft SharePoint 2013 SP1 - 'DestinationFolder' Persistant Cross-Site Scripting	25 Sep 201900:00	–	exploitdb
EUVD	EUVD-2019-9827	7 Oct 202500:30	–	euvd
exploitpack	Microsoft SharePoint 2013 SP1 - DestinationFolder Persistant Cross-Site Scripting	25 Sep 201900:00	–	exploitpack
Microsoft KB	Description of the security update for SharePoint Foundation 2013: September 10, 2019	10 Sep 201907:00	–	mskb
Kaspersky	KLA11551 Multiple vulnerabilities in Microsoft Office	10 Sep 201900:00	–	kaspersky

NVD

Vulners

Node

microsoft sharepoint_foundationMatch2013sp1

[
  {
    "product": "Microsoft SharePoint Foundation",
    "vendor": "Microsoft",
    "versions": [
      {
        "status": "affected",
        "version": "2013 Service Pack 1"
      }
    ]
  }
]

Source	Link
portal	www.portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1262
packetstormsecurity	www.packetstormsecurity.com/files/154591/Microsoft-SharePoint-2013-SP1-Cross-Site-Scripting.html

Parameter	Position	Path	Description	CWE
ctl00$PlaceHolderMain$ctl01$ctl04$InputFile	request body	FOLDER/_layouts/15/Upload.aspx?List={689D112C-BDAA-4B05-B0CB-0DFB36CF0649}&RootFolder=&IsDlg=1	Stored XSS in filename during file upload via Upload.aspx; the filename is reflected in the aria-label attribute, enabling XSS when uploaded by an authenticated user.	CWE-79

17 Jun 2026 02:28Current

5.1Medium risk

Vulners AI Score5.1

CVSS 23.5

CVSS 3.15.4

EPSS0.02993

CWE-79