CVE-2020-1147

Description

A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and Visual Studio when the software fails to check the source markup of XML file input, aka '.NET Framework, SharePoint Server, and Visual Studio Remote Code Execution Vulnerability'.

Related CPE's

amicrosoft.net_core2.1*******

amicrosoft.net_core3.1*******

amicrosoft.net_framework2.0sp2******

amicrosoft.net_framework3.0sp2******

omicrosoftwindows_server_2008-sp2******

amicrosoft.net_framework3.5*******

omicrosoftwindows_server_2012r2*******

omicrosoftwindows_8.1-*******

omicrosoftwindows_server_2012-*******

amicrosoft.net_framework4.6.2*******

References

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1147

PatchVendor Advisory

http://packetstormsecurity.com/files/158694/SharePoint-DataSet-DataTable-Deserialization.html

ExploitThird Party AdvisoryVDB Entry

http://packetstormsecurity.com/files/158876/Microsoft-SharePoint-Server-2019-Remote-Code-Execution.html

ExploitThird Party AdvisoryVDB Entry

https://www.exploitalert.com/view-details.html?id=35992

ExploitThird Party Advisory

http://packetstormsecurity.com/files/163644/Microsoft-SharePoint-Server-2019-Remote-Code-Execution.html

ExploitThird Party AdvisoryVDB Entry

CvssV3 impact

BaseSeverity

HIGH

ConfidentialityImpact

HIGH

AttackComplexity

LOW

Scope

UNCHANGED

AttackVector

LOCAL

AvailabilityImpact

HIGH

IntegrityImpact

HIGH

PrivilegesRequired

NONE

BaseScore

7.8

VectorString

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Version

3.1

UserInteraction

REQUIRED

CvssV2 impact

AccessComplexity

MEDIUM

ConfidentialityImpact

PARTIAL

AvailabilityImpact

PARTIAL

IntegrityImpact

PARTIAL

BaseScore

6.800000190734863

VectorString

AV:N/AC:M/Au:N/C:P/I:P/A:P

Version

2.0

AccessVector

NETWORK

Authentication

NONE

Created by Yello
About Severity.io