The CVSS 5.4 score on this CVE masks a serious gap in how defenders assess SharePoint vulnerabilities. The 'authorized attacker' constraint mathematically reduces the score, but in practice, SharePoint's permission model grants edit or contribute rights to thousands of users per organization — project teams, department heads, contractors, external collaborators. Authorization here doesn't imply trustworthiness: credential theft via phishing, insider threat, or supply-chain compromise all grant the 'authorized' access needed to exploit this XSS.
The real danger isn't in the initial exploit — it's in what happens after. SharePoint functions as the authentication and integration hub for the M365 ecosystem, circulating session context, federation tokens, and Azure AD claims across Teams, Power Platform, and connected applications. A persistent XSS foothold in SharePoint isn't a document-integrity problem; it's a lateral-movement primitive that can reach authentication context for your entire collaboration stack. Worse, SharePoint's audit trail and versioning — the infrastructure you rely on for incident response — may themselves be accessible to an attacker who has established session persistence.
The EPSS score of 0.00283 reflects external scanning probability, not insider exploitation likelihood. These are structurally different risk distributions. SharePoint has accumulated code since 2001 across multiple UI paradigms, and the 'authorized attacker' classification has historically insulated such code from aggressive security scrutiny. The 2023 M365 breaches began with known CVEs in collaboration tools that organizations had deprioritized — the CVSS 5.4 rating is a reliable predictor of exactly that pattern repeating.
Prioritize this patch in environments with high user volume, external collaboration, or integration with Power Automate workflows. Treat the 'authorized' constraint as a classification artifact, not a减轻 factor in your threat model. Verify that your detection logic monitors for XSS exploitation BEFORE it reaches the audit-log manipulation window.