10

CVE-2020-0646

Warnung
Exploit
A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka '.NET Framework Remote Code Execution Injection Vulnerability'.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Microsoft ≫ .Net Framework Version 3.0 Update sp2
   Microsoft ≫ Windows Server 2008 Version - Update sp2
Microsoft ≫ .Net Framework Version 3.5
   Microsoft ≫ Windows 10 1607 Version - HwPlatform x64
   Microsoft ≫ Windows 10 1607 Version - HwPlatform x86
   Microsoft ≫ Windows 8.1
   Microsoft ≫ Windows Server 2012 Version -
   Microsoft ≫ Windows Server 2012 Version r2
Microsoft ≫ .Net Framework Version 3.5
   Microsoft ≫ Windows 10 1607 Version - HwPlatform x64
   Microsoft ≫ Windows 10 1607 Version - HwPlatform x86
   Microsoft ≫ Windows Server 2016 Version -
Microsoft ≫ .Net Framework Version 4.6.2
   Microsoft ≫ Windows 10 1607 Version - HwPlatform x64
   Microsoft ≫ Windows 10 1607 Version - HwPlatform x86
   Microsoft ≫ Windows Server 2016 Version -
Microsoft ≫ .Net Framework Version 4.7
   Microsoft ≫ Windows 10 1607 Version - HwPlatform x64
   Microsoft ≫ Windows 10 1607 Version - HwPlatform x86
   Microsoft ≫ Windows Server 2016 Version -
Microsoft ≫ .Net Framework Version 4.7.1
   Microsoft ≫ Windows 10 1607 Version - HwPlatform x64
   Microsoft ≫ Windows 10 1607 Version - HwPlatform x86
   Microsoft ≫ Windows Server 2016 Version -
Microsoft ≫ .Net Framework Version 4.7.2
   Microsoft ≫ Windows 10 1607 Version - HwPlatform x64
   Microsoft ≫ Windows 10 1607 Version - HwPlatform x86
   Microsoft ≫ Windows Server 2016 Version -
Microsoft ≫ .Net Framework Version 3.5
   Microsoft ≫ Windows 10 1709 Version - HwPlatform x64
   Microsoft ≫ Windows 10 1709 Version - HwPlatform x86
Microsoft ≫ .Net Framework Version 4.7.1
   Microsoft ≫ Windows 10 1709 Version - HwPlatform x64
   Microsoft ≫ Windows 10 1709 Version - HwPlatform x86
Microsoft ≫ .Net Framework Version 4.7.2
   Microsoft ≫ Windows 10 1709 Version - HwPlatform x64
   Microsoft ≫ Windows 10 1709 Version - HwPlatform x86
Microsoft ≫ .Net Framework Version 3.5
   Microsoft ≫ Windows 10 1507 Version - HwPlatform x64
   Microsoft ≫ Windows 10 1507 Version - HwPlatform x86
   Microsoft ≫ Windows 10 1803 Version - HwPlatform x64
   Microsoft ≫ Windows 10 1803 Version - HwPlatform x86
   Microsoft ≫ Windows 10 1809 Version - HwPlatform x64
   Microsoft ≫ Windows 10 1809 Version - HwPlatform x86
   Microsoft ≫ Windows Server 2016 Version 1803
   Microsoft ≫ Windows Server 2019
Microsoft ≫ .Net Framework Version 4.7.2
   Microsoft ≫ Windows 10 1507 Version - HwPlatform x64
   Microsoft ≫ Windows 10 1507 Version - HwPlatform x86
   Microsoft ≫ Windows 10 1803 Version - HwPlatform x64
   Microsoft ≫ Windows 10 1803 Version - HwPlatform x86
   Microsoft ≫ Windows 10 1809 Version - HwPlatform x64
   Microsoft ≫ Windows 10 1809 Version - HwPlatform x86
   Microsoft ≫ Windows Server 2016 Version 1803
   Microsoft ≫ Windows Server 2019
Microsoft ≫ .Net Framework Version 3.5
   Microsoft ≫ Windows 10 1809 Version -
   Microsoft ≫ Windows 10 1903 Version -
   Microsoft ≫ Windows 10 1909 Version -
   Microsoft ≫ Windows Server 2016 Version 1909
   Microsoft ≫ Windows Server 2019
Microsoft ≫ .Net Framework Version 4.8
   Microsoft ≫ Windows 10 1809 Version -
   Microsoft ≫ Windows 10 1903 Version -
   Microsoft ≫ Windows 10 1909 Version -
   Microsoft ≫ Windows Server 2016 Version 1909
   Microsoft ≫ Windows Server 2019
Microsoft ≫ .Net Framework Version 3.5.1
   Microsoft ≫ Windows 7 Version - Update sp1
   Microsoft ≫ Windows Server 2008 Version r2 Update sp1 HwPlatform itanium
   Microsoft ≫ Windows Server 2008 Version r2 Update sp1 HwPlatform x64
Microsoft ≫ .Net Framework Version 4.5.2
   Microsoft ≫ Windows 7 Version - Update sp1
   Microsoft ≫ Windows 8.1
   Microsoft ≫ Windows Rt 8.1
   Microsoft ≫ Windows Server 2008 Version - Update sp2
   Microsoft ≫ Windows Server 2008 Version r2 Update sp1 HwPlatform x64
   Microsoft ≫ Windows Server 2012 Version -
   Microsoft ≫ Windows Server 2012 Version r2
Microsoft ≫ .Net Framework Version 4.6
   Microsoft ≫ Windows Server 2008 Version - Update sp2
Microsoft ≫ .Net Framework Version 4.6.2
   Microsoft ≫ Windows 10 1607 Version - HwPlatform x86
Microsoft ≫ .Net Framework Version 4.7
   Microsoft ≫ Windows 10 1607 Version - HwPlatform x86
Microsoft ≫ .Net Framework Version 4.7.1
   Microsoft ≫ Windows 10 1607 Version - HwPlatform x86
Microsoft ≫ .Net Framework Version 4.7.2
   Microsoft ≫ Windows 10 1607 Version - HwPlatform x86
Microsoft ≫ .Net Framework Version 4.6
   Microsoft ≫ Windows 7 Version - Update sp1
   Microsoft ≫ Windows 8.1
   Microsoft ≫ Windows Rt 8.1
   Microsoft ≫ Windows Server 2008 Version r2 Update sp1 HwPlatform x64
   Microsoft ≫ Windows Server 2012 Version -
   Microsoft ≫ Windows Server 2012 Version r2
Microsoft ≫ .Net Framework Version 4.6.1
   Microsoft ≫ Windows 7 Version - Update sp1
   Microsoft ≫ Windows 8.1
   Microsoft ≫ Windows Rt 8.1
   Microsoft ≫ Windows Server 2008 Version r2 Update sp1 HwPlatform x64
   Microsoft ≫ Windows Server 2012 Version -
   Microsoft ≫ Windows Server 2012 Version r2
Microsoft ≫ .Net Framework Version 4.6.2
   Microsoft ≫ Windows 7 Version - Update sp1
   Microsoft ≫ Windows 8.1
   Microsoft ≫ Windows Rt 8.1
   Microsoft ≫ Windows Server 2008 Version r2 Update sp1 HwPlatform x64
   Microsoft ≫ Windows Server 2012 Version -
   Microsoft ≫ Windows Server 2012 Version r2
Microsoft ≫ .Net Framework Version 4.7
   Microsoft ≫ Windows 7 Version - Update sp1
   Microsoft ≫ Windows 8.1
   Microsoft ≫ Windows Rt 8.1
   Microsoft ≫ Windows Server 2008 Version r2 Update sp1 HwPlatform x64
   Microsoft ≫ Windows Server 2012 Version -
   Microsoft ≫ Windows Server 2012 Version r2
Microsoft ≫ .Net Framework Version 4.7.1
   Microsoft ≫ Windows 7 Version - Update sp1
   Microsoft ≫ Windows 8.1
   Microsoft ≫ Windows Rt 8.1
   Microsoft ≫ Windows Server 2008 Version r2 Update sp1 HwPlatform x64
   Microsoft ≫ Windows Server 2012 Version -
   Microsoft ≫ Windows Server 2012 Version r2
Microsoft ≫ .Net Framework Version 4.7.2
   Microsoft ≫ Windows 7 Version - Update sp1
   Microsoft ≫ Windows 8.1
   Microsoft ≫ Windows Rt 8.1
   Microsoft ≫ Windows Server 2008 Version r2 Update sp1 HwPlatform x64
   Microsoft ≫ Windows Server 2012 Version -
   Microsoft ≫ Windows Server 2012 Version r2
Microsoft ≫ .Net Framework Version 4.8
   Microsoft ≫ Windows 10 1607 Version -
   Microsoft ≫ Windows 10 1709 Version -
   Microsoft ≫ Windows 10 1803 Version -
   Microsoft ≫ Windows 7 Version - Update sp1
   Microsoft ≫ Windows 8.1
   Microsoft ≫ Windows Rt 8.1
   Microsoft ≫ Windows Server 2008 Version r2 Update sp1 HwPlatform x64
   Microsoft ≫ Windows Server 2012 Version -
   Microsoft ≫ Windows Server 2012 Version r2
   Microsoft ≫ Windows Server 2016 Version -

03.11.2021: CISA Known Exploited Vulnerabilities (KEV) Catalog

Microsoft .NET Framework Remote Code Execution Vulnerability

Schwachstelle

Microsoft .NET Framework contains an improper input validation vulnerability that allows for remote code execution.

Beschreibung

Apply updates per vendor instructions.

Erforderliche Maßnahmen
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 99.22% 0.999
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NIST 10 10 10
AV:N/AC:L/Au:N/C:C/I:C/A:C
CISA-ADP 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-91 XML Injection (aka Blind XPath Injection)

The product does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.

http://packetstormsecurity.com/files/156930/SharePoint-Workflows-XOML-Injection.html
Third Party Advisory
Exploit
VDB Entry
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0646
Patch
Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-0646
US Government Resource