CVE-2020-1147

Warnung

Exploit

EPSS 94.35%
Veröffentlicht 14.07.2020 23:15:12
Zuletzt bearbeitet 29.10.2025 13:55:42
Erkennungen
Login

A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and Visual Studio when the software fails to check the source markup of XML file input, aka '.NET Framework, SharePoint Server, and Visual Studio Remote Code Execution Vulnerability'.

Betroffene Produkte Warnungen 1 Metriken 4 CWE 0 Referenzen 9

NVD 41 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Microsoft ≫ .Net Core Version 2.1

Microsoft ≫ .Net Core Version 3.1

Microsoft ≫ .Net Framework Version 2.0 Update sp2

Microsoft ≫ Windows Server 2008 Version - Update sp2

Microsoft ≫ .Net Framework Version 3.0 Update sp2

Microsoft ≫ Windows Server 2008 Version - Update sp2

Microsoft ≫ .Net Framework Version 3.5

   Microsoft ≫ Windows 8.1 Version -
   Microsoft ≫ Windows Server 2012 Version -
   Microsoft ≫ Windows Server 2012 Version r2

Microsoft ≫ .Net Framework Version 3.5

Microsoft ≫ Windows 10 Version 1607
Microsoft ≫ Windows Server 2016 Version -

Microsoft ≫ .Net Framework Version 4.6.2

Microsoft ≫ Windows 10 Version 1607
Microsoft ≫ Windows Server 2016 Version -

Microsoft ≫ .Net Framework Version 4.7

Microsoft ≫ Windows 10 Version 1607
Microsoft ≫ Windows Server 2016 Version -

Microsoft ≫ .Net Framework Version 4.7.1

Microsoft ≫ Windows 10 Version 1607
Microsoft ≫ Windows Server 2016 Version -

Microsoft ≫ .Net Framework Version 4.7.2

Microsoft ≫ Windows 10 Version 1607
Microsoft ≫ Windows Server 2016 Version -

Microsoft ≫ .Net Framework Version 3.5

Microsoft ≫ Windows 10 Version -

Microsoft ≫ .Net Framework Version 4.6

Microsoft ≫ Windows 10 Version -

Microsoft ≫ .Net Framework Version 4.6.1

Microsoft ≫ Windows 10 Version -

Microsoft ≫ .Net Framework Version 4.6.2

Microsoft ≫ Windows 10 Version -

Microsoft ≫ .Net Framework Version 3.5

Microsoft ≫ Windows 10 Version -

Microsoft ≫ .Net Framework Version 4.6

Microsoft ≫ Windows 10 Version -

Microsoft ≫ .Net Framework Version 4.6.1

Microsoft ≫ Windows 10 Version -

Microsoft ≫ .Net Framework Version 4.6.2

Microsoft ≫ Windows 10 Version -

Microsoft ≫ .Net Framework Version 3.5

Microsoft ≫ Windows 10 Version 1709

Microsoft ≫ .Net Framework Version 4.7.1

Microsoft ≫ Windows 10 Version 1709

Microsoft ≫ .Net Framework Version 4.7.2

Microsoft ≫ Windows 10 Version 1709

Microsoft ≫ .Net Framework Version 3.5

   Microsoft ≫ Windows 10 Version 1803
   Microsoft ≫ Windows 10 Version 1809
   Microsoft ≫ Windows Server 2016 Version 1803
   Microsoft ≫ Windows Server 2019 Version -

Microsoft ≫ .Net Framework Version 4.7.2

   Microsoft ≫ Windows 10 Version 1803
   Microsoft ≫ Windows 10 Version 1809
   Microsoft ≫ Windows Server 2016 Version 1803
   Microsoft ≫ Windows Server 2019 Version -

Microsoft ≫ .Net Framework Version 3.5

   Microsoft ≫ Windows 10 Version 1809
   Microsoft ≫ Windows 10 Version 1903
   Microsoft ≫ Windows 10 Version 1909
   Microsoft ≫ Windows 10 Version 2004
   Microsoft ≫ Windows Server 2016 Version 1903
   Microsoft ≫ Windows Server 2016 Version 1909
   Microsoft ≫ Windows Server 2016 Version 2004
   Microsoft ≫ Windows Server 2019 Version -

Microsoft ≫ .Net Framework Version 4.8

Microsoft ≫ .Net Framework Version 3.5.1

Microsoft ≫ Windows 7 Version - Update sp1
Microsoft ≫ Windows Server 2008 Version r2 Update sp1 HwPlatform x64

Microsoft ≫ .Net Framework Version 4.5.2

   Microsoft ≫ Windows 7 Version - Update sp1
   Microsoft ≫ Windows 8.1 Version -
   Microsoft ≫ Windows Rt 8.1 Version -
   Microsoft ≫ Windows Server 2008 Version - Update sp2
   Microsoft ≫ Windows Server 2008 Version r2 Update sp1 HwPlatform x64
   Microsoft ≫ Windows Server 2012 Version -
   Microsoft ≫ Windows Server 2012 Version r2

Microsoft ≫ .Net Framework Version 4.6

Microsoft ≫ Windows Server 2008 Version - Update sp2

Microsoft ≫ .Net Framework Version 4.6

   Microsoft ≫ Windows 7 Version - Update sp1
   Microsoft ≫ Windows 8.1 Version -
   Microsoft ≫ Windows Server 2008 Version r2 Update sp1
   Microsoft ≫ Windows Server 2012 Version -
   Microsoft ≫ Windows Server 2012 Version r2

Microsoft ≫ .Net Framework Version 4.6.1

Microsoft ≫ .Net Framework Version 4.6.2

Microsoft ≫ .Net Framework Version 4.7

Microsoft ≫ .Net Framework Version 4.7.1

Microsoft ≫ .Net Framework Version 4.7.2

Microsoft ≫ .Net Framework Version 4.8

   Microsoft ≫ Windows 10 Version 1607
   Microsoft ≫ Windows 10 Version 1709
   Microsoft ≫ Windows 10 Version 1803
   Microsoft ≫ Windows 7 Version - Update sp1
   Microsoft ≫ Windows 8.1 Version -
   Microsoft ≫ Windows Rt 8.1 Version -
   Microsoft ≫ Windows Server 2008 Version r2 Update sp1 HwPlatform x64
   Microsoft ≫ Windows Server 2012 Version -
   Microsoft ≫ Windows Server 2012 Version r2
   Microsoft ≫ Windows Server 2016 Version -
   Microsoft ≫ Windows Server 2016 Version 1803

Microsoft ≫ Sharepoint Enterprise Server Version 2013 Update sp1

Microsoft ≫ Sharepoint Enterprise Server Version 2016

Microsoft ≫ Sharepoint Server Version 2010 Update sp2

Microsoft ≫ Sharepoint Server Version 2019

Microsoft ≫ Visual Studio 2017 Version >= 15.0 <= 15.9

Microsoft ≫ Visual Studio 2019 Version >= 16.0 <= 16.6

03.11.2021: CISA Known Exploited Vulnerabilities (KEV) Catalog

Microsoft .NET Framework, SharePoint, and Visual Studio Remote Code Execution Vulnerability

Schwachstelle

Microsoft .NET Framework, Microsoft SharePoint, and Visual Studio contain a remote code execution vulnerability when the software fails to check the source markup of XML file input. Successful exploitation allows an attacker to execute code in the context of the process responsible for deserialization of the XML content.

Beschreibung

Apply updates per vendor instructions.

Erforderliche Maßnahmen

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	94.35%	0.998

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
NIST	7.8	1.8	5.9	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NIST	6.8	8.6	6.4	AV:N/AC:M/Au:N/C:P/I:P/A:P
CISA-ADP	7.8	1.8	5.9	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Es wurden noch keine Informationen zu CWE veröffentlicht.

http://packetstormsecurity.com/files/158694/SharePoint-DataSet-DataTable-Deserialization.html

Third Party Advisory

Exploit

VDB Entry

http://packetstormsecurity.com/files/158876/Microsoft-SharePoint-Server-2019-Remote-Code-Execution.html

Third Party Advisory

Exploit

VDB Entry

http://packetstormsecurity.com/files/163644/Microsoft-SharePoint-Server-2019-Remote-Code-Execution.html

Third Party Advisory

Exploit

VDB Entry

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1147

Patch

Vendor Advisory

https://www.exploitalert.com/view-details.html?id=35992

Third Party Advisory

Exploit

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-1147

US Government Resource

https://nvd.nist.gov/vuln/detail/CVE-2020-1147

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2020-1147

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2020-1147

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2020-1147

03.11.2021: CISA Known Exploited Vulnerabilities (KEV) Catalog