CVE-2020-16942 Microsoft SharePoint Information Disclosure Vulnerability

What is CVE-2020-16942?

CVE-2020-16942 is a medium-severity vulnerability in Microsoft Sharepoint Enterprise Server, published on 16 Oct 2020. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

<p>An information disclosure vulnerability exists when Microsoft SharePoint Server improperly discloses its folder structure when rendering specific web pages. An attacker who took advantage of this information disclosure could view the folder path of scripts loaded on the page.</p> <p>To take advantage of the vulnerability, an attacker would require access to the specific SharePoint page affected by this vulnerability.</p> <p>The security update addresses the vulnerability by correcting how scripts are referenced on some SharePoint pages.</p>

Which versions are affected by CVE-2020-16942?

It affects 3 products.

Products include Microsoft Sharepoint Enterprise Server, Microsoft Sharepoint Foundation, Microsoft Sharepoint Server.

How do I fix CVE-2020-16942?

No fix has been published for CVE-2020-16942 yet. Limit exposure of the affected software until one is available.

Is CVE-2020-16942 being exploited?

There is no known exploitation of CVE-2020-16942 in the wild and no public exploit code.

Other vulnerabilities in Microsoft Sharepoint Enterprise Server

• CVE-2019-0604 Microsoft SharePoint Remote Code Execution Exploited Critical 9.8
• CVE-2023-24955 Microsoft SharePoint Server Code Injection Exploited High 7.2
• CVE-2025-49706 Microsoft SharePoint Improper Authentication Exploited Medium 6.5
• CVE-2020-1210 Microsoft SharePoint Remote Code Execution Vulnerability Critical 9.9
• CVE-2020-1595 Microsoft SharePoint Remote Code Execution Vulnerability Critical 9.9

All Microsoft Sharepoint Enterprise Server vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-hhw5-x523-g8hv.