Cross-origin spoofing via improperly validated origins

Origin-validation spoofing in Microsoft Office Online Server allows remote attackers to perform cross-origin attacks via crafted requests. Cross-origin communication handlers accept a request origin without correctly validating that it is trusted, allowing an attacker-controlled origin to read content and issue actions through the victim's authenticated session. A victim must be authenticated and interact with attacker-controlled content; the established impact is unauthorized content access and actions under that victim's identity.