Authenticated cross-site scripting via unsanitized web requests

Cross-site scripting in Microsoft SharePoint and Project Server allows remote authenticated users to run script in a victim's browser. The web-request handling path returns attacker-controlled input without sufficient sanitization, causing the browser to interpret it as script; Microsoft has not disclosed a narrower endpoint or function. Exploitation requires SharePoint credentials and user interaction, and the script can read unauthorized content or act with the victim's site permissions, including changing permissions and deleting content.