CVE-2020-1439

high-risk

Published 2020-07-14

A remote code execution vulnerability exists in PerformancePoint Services for SharePoint Server when the software fails to check the source markup of XML file input, aka 'PerformancePoint Services Remote Code Execution Vulnerability'.

Do I need to act?

31.2% chance of exploitation in next 30 days

EPSS score — higher than 69% of all CVEs

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 8.8/10 High

NETWORK / LOW complexity

Affected Products (5)

Sharepoint Enterprise Server

Sharepoint Foundation

Sharepoint Server

Affected Vendors

Microsoft

References (4)

Patch https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1439

Third Party Advisory https://www.zerodayinitiative.com/advisories/ZDI-20-874/

Patch https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1439

Third Party Advisory https://www.zerodayinitiative.com/advisories/ZDI-20-874/

/ 100

high-risk

Severity 30/34 · Critical

Exploitability 16/34 · Moderate

Exposure 12/34 · Low