CVE-2017-8569 Cross-site scripting in Microsoft SharePoint Enterprise Server 2016
An attacker can exploit improper sanitization in SharePoint Server to achieve privilege escalation via cross-site scripting.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-8569?
CVE-2017-8569 is a high-severity cross-site scripting vulnerability in Microsoft Sharepoint Server, published on 11 Jul 2017. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Microsoft SharePoint Server allows an elevation of privilege vulnerability due to the way that it sanitizes a specially crafted web request to an affected SharePoint server, aka "SharePoint Server XSS Vulnerability".
Weakness: CWE-79
Which versions are affected by CVE-2017-8569?
It affects 1 product.
Products include Microsoft Sharepoint Server.
How do I fix CVE-2017-8569?
No fix has been published for CVE-2017-8569 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2017-8569 being exploited?
There is no known exploitation of CVE-2017-8569 in the wild and no public exploit code.
Other vulnerabilities in Microsoft Sharepoint Server
- CVE-2026-50522 Microsoft SharePoint Deserialization of Untrusted Data Vulnerability
- CVE-2026-58644 Microsoft SharePoint Deserialization of Untrusted Data
- CVE-2026-20963 Microsoft SharePoint Deserialization of Untrusted Data
- CVE-2025-53770 Microsoft SharePoint Deserialization of Untrusted Data
- CVE-2023-29357 Microsoft SharePoint Server Privilege Escalation
Sources
Also known as GHSA-hq49-pqh6-q532.