Vulnerability Description
A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and Visual Studio when the software fails to check the source markup of XML file input, aka '.NET Framework, SharePoint Server, and Visual Studio Remote Code Execution Vulnerability'.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Microsoft | .Net Core | 2.1 |
| Microsoft | .Net Framework | 2.0 |
| Microsoft | Windows Server 2008 | - |
| Microsoft | Windows 8.1 | - |
| Microsoft | Windows Server 2012 | - |
| Microsoft | Windows 10 | 1607 |
| Microsoft | Windows Server 2016 | - |
| Microsoft | Windows Server 2019 | - |
| Microsoft | Windows 7 | - |
| Microsoft | Windows Rt 8.1 | - |
| Microsoft | Sharepoint Enterprise Server | 2013 |
| Microsoft | Sharepoint Server | 2010 |
| Microsoft | Visual Studio 2017 | >= 15.0, <= 15.9 |
| Microsoft | Visual Studio 2019 | >= 16.0, <= 16.6 |
References
- http://packetstormsecurity.com/files/158694/SharePoint-DataSet-DataTable-DeseriaExploitThird Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/158876/Microsoft-SharePoint-Server-2019-RemExploitThird Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/163644/Microsoft-SharePoint-Server-2019-RemExploitThird Party AdvisoryVDB Entry
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1147PatchVendor Advisory
- https://www.exploitalert.com/view-details.html?id=35992ExploitThird Party Advisory
- http://packetstormsecurity.com/files/158694/SharePoint-DataSet-DataTable-DeseriaExploitThird Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/158876/Microsoft-SharePoint-Server-2019-RemExploitThird Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/163644/Microsoft-SharePoint-Server-2019-RemExploitThird Party AdvisoryVDB Entry
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1147PatchVendor Advisory
- https://www.exploitalert.com/view-details.html?id=35992ExploitThird Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-US Government Resource
FAQ
What is CVE-2020-1147?
CVE-2020-1147 is a vulnerability with a CVSS score of 7.8 (HIGH). A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and Visual Studio when the software fails to check the source markup of XML file input, aka '.NET Framework, Share...
How severe is CVE-2020-1147?
CVE-2020-1147 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-1147?
Check the references section above for vendor advisories and patch information. Affected products include: Microsoft .Net Core, Microsoft .Net Framework, Microsoft Windows Server 2008, Microsoft Windows 8.1, Microsoft Windows Server 2012.