CVE-2020-1147

critical-risk
Published 2020-07-14

A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and Visual Studio when the software fails to check the source markup of XML file input, aka '.NET Framework, SharePoint Server, and Visual Studio Remote Code Execution Vulnerability'.

Do I need to act?

!
93.4% chance of exploitation in next 30 days
EPSS score — higher than 7% of all CVEs
!
CISA KEV: actively exploited in the wild
On the Known Exploited Vulnerabilities catalog — federal agencies must patch
!
2 public exploits available
48747, 50151
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.8/10 High
LOCAL / LOW complexity

Affected Products (20)

Affected Vendors

Microsoft

References (11)

Exploit http://packetstormsecurity.com/files/158694/SharePoint-DataSet-DataTable-Deseria...
Exploit http://packetstormsecurity.com/files/158876/Microsoft-SharePoint-Server-2019-Rem...
Exploit http://packetstormsecurity.com/files/163644/Microsoft-SharePoint-Server-2019-Rem...
Patch https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1147
Exploit https://www.exploitalert.com/view-details.html?id=35992
Exploit http://packetstormsecurity.com/files/158694/SharePoint-DataSet-DataTable-Deseria...
Exploit http://packetstormsecurity.com/files/158876/Microsoft-SharePoint-Server-2019-Rem...
Exploit http://packetstormsecurity.com/files/163644/Microsoft-SharePoint-Server-2019-Rem...
Patch https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1147
Exploit https://www.exploitalert.com/view-details.html?id=35992
US Government Resource https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-...
71
/ 100
critical-risk
Severity 24/34 · High
Exploitability 27/34 · High
Exposure 20/34 · Moderate