8.8

CVE-2020-1439

A remote code execution vulnerability exists in PerformancePoint Services for SharePoint Server when the software fails to check the source markup of XML file input, aka 'PerformancePoint Services Remote Code Execution Vulnerability'.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Microsoft ≫ Sharepoint Enterprise Server Version 2013 Update sp1
Microsoft ≫ Sharepoint Foundation Version 2013 Update sp1
Microsoft ≫ Sharepoint Server Version 2010 Update sp2
Microsoft ≫ Sharepoint Server Version 2019
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 20.27% 0.971
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NIST 6.5 8 6.4
AV:N/AC:L/Au:S/C:P/I:P/A:P
CWE-502 Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1439
Patch
Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-20-874/
Third Party Advisory