{"schemaVersion":3,"id":"CVE-2019-0558","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka \"Microsoft Office SharePoint XSS Vulnerability.\" This affects Microsoft SharePoint Server, Microsoft SharePoint, Microsoft Business Productivity Servers. This CVE ID is unique from CVE-2019-0556, CVE-2019-0557.","dates":{"published":"2019-01-08T21:00:00.000Z","modified":"2025-02-28T20:14:09.112Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":5.4,"severity":"medium","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":5.4,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":5.4,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","exploitability":null,"impact":null,"computed":false},{"version":"3.0","versionLabel":"v3.0","source":"NVD","score":5.4,"severity":"medium","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":3.5,"severity":"low","vector":"AV:N/AC:M/Au:S/C:N/I:P/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.01996,"percentile":0.80417,"severity":"low","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.01996},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.01996,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.01996,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.01996,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.01996,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.01996,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.01996,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.01996,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.01972,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.01996,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.01996,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.01996,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.01996,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.01996,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.01996,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.01996,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.01996,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.01996,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.01996,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.01996,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.01996,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.01996,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.01996,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.01996,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.01996,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.01996,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.01996,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.01996,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.01996,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.01996,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.01996,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.01996,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.01996,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.01996,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.01996,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.01996,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.01996,"percentile":0.80417}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.01996,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.01996,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.01972,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.01996,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.01996,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.01996,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.01996,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.01996,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.01996,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.01996,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.01996,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.01996,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.01996,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.01996,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.01996,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.01996,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.01996,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.01996,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.01996,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.01996,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.01996,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.01996,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.01996,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.01996,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.01996,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.01996,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.01996,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.01996,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.01996,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.01996,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.01996,"percentile":0.80417}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.","type":"weakness","status":"Stable","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/79.html"}],"affected":[{"vendor":"microsoft","product":"business_productivity_servers","name":"business productivity servers","label":"business_productivity_servers","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"2010:sp2","noFixRecorded":false,"fixedIn":null}],"versionsText":"2010:sp2","eol":null,"hubHref":"/vendor/microsoft/business_productivity_servers"},{"vendor":"microsoft","product":"microsoft business productivity servers","name":"Microsoft Business Productivity Servers","label":"microsoft business productivity servers","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"2010 Service Pack 2","noFixRecorded":false,"fixedIn":null}],"versionsText":"2010 Service Pack 2","eol":null,"hubHref":"/vendor/microsoft/microsoft_business_productivity_servers"},{"vendor":"microsoft","product":"microsoft sharepoint","name":"Microsoft SharePoint","label":"microsoft sharepoint","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"Enterprise Server 2013 Service Pack 1","noFixRecorded":false,"fixedIn":null},{"text":"Enterprise Server 2016","noFixRecorded":false,"fixedIn":null}],"versionsText":"Enterprise Server 2013 Service Pack 1 | Enterprise Server 2016","eol":{"isEol":null,"eolDate":null,"matchMethod":"name_exact","cycle":null,"product":{"name":"sharepoint","label":"Microsoft SharePoint","category":"server-app"}},"hubHref":"/vendor/microsoft/microsoft_sharepoint"},{"vendor":"microsoft","product":"microsoft sharepoint server","name":"Microsoft SharePoint Server","label":"microsoft sharepoint server","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"2019","noFixRecorded":false,"fixedIn":null}],"versionsText":"2019","eol":null,"hubHref":"/vendor/microsoft/microsoft_sharepoint_server"},{"vendor":"microsoft","product":"sharepoint_server","name":"sharepoint server","label":"sharepoint_server","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"2013:sp1","noFixRecorded":false,"fixedIn":null},{"text":"2016","noFixRecorded":false,"fixedIn":null},{"text":"2019","noFixRecorded":false,"fixedIn":null}],"versionsText":"2013:sp1 | 2016 | 2019","eol":null,"hubHref":"/vendor/microsoft/sharepoint_server"}],"affectedCount":5,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0558","label":"portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0558","hostname":"portal.msrc.microsoft.com","tags":["X Refsource CONFIRM","Patch","Vendor Advisory"]},{"url":"http://www.securityfocus.com/bid/106389","label":"www.securityfocus.com/bid/106389","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID","Third Party Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2019-01-08T21:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2025-02-28T20:14:09.112Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":22,"level":"low","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T05:54:52.886Z","stale":false,"partial":false}}