CVE-2014-1754

Microsoft SharePoint Server 2013 and Office Web Apps Server 2013 - Cross-Site Scripting

Title source: llm

Description

Cross-site scripting (XSS) vulnerability in Microsoft SharePoint Server 2013 Gold and SP1, SharePoint Foundation 2013 Gold and SP1, Office Web Apps Server 2013 Gold and SP1, and SharePoint Server 2013 Client Components SDK allows remote attackers to inject arbitrary web script or HTML via a crafted request, aka "SharePoint XSS Vulnerability."

References (3)

Core 3

Core References

Vendor Advisory vendor-advisory x_refsource_ms

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-022

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://www.securitytracker.com/id/1030227

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/67288

Scores

EPSS 0.1107

EPSS Percentile 95.5%

Details

CWE

CWE-79

Status published

Products (4)

microsoft/office_web_apps_server 2013 (2 CPE variants)

microsoft/sharepoint_foundation 2013 (2 CPE variants)

microsoft/sharepoint_server 2013 (2 CPE variants)

microsoft/sharepoint_server_client_components_sdk 2013

Published May 14, 2014

Tracked Since Feb 18, 2026