0

There is a link that MS advises to disable client integration feature to prevent cross site scripting

"In the event there is a cross site scripting attack using WebDAV by contributors to a site, a SharePoint administrator can protect their site by disabling all client integration."

https://support.microsoft.com/en-sg/help/2758444/sharepoint-2013---disable-webdav-use-on-sharepoint

I have a little bit confuse the term "contributor" here, does it mean who has contributor right will be able to do the attacking? how about anonymous?

I have a facing internet site which allow anonymous access, should I disable it?

Any ideas would be greatly appreciated.

1

Here "contributor" means the one who has the rights to contribute on this SharePoint site - in fact, edit items and delete item versions (or even edit lists\libraries etc).

So if this alleged contributor has bad intentions for Cross-site Scripting (XSS) attack then you can disable WebDAV use on SharePoint.

However if this site is not internet-faced (meaning placed in local intranet) then i will advise not doing so.

Please note that disabling WebDAV is very strict measure and should be used only if there is an urgent security reason.

Better use the Lockdown Mode, available as a feature.

Here are details. And this is also suitable for internet-faced sites.

1
  • Hi Sergey, thanks a lot, I enabled the lockdown mode, all contributors are internal users and only allowed anonymous to read items (library, list, pages), it would be safe to keep it enable. Thanks.
    – Jay Chen
    May 19 '17 at 2:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.