CVSS 3.1
7.8 highCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HCVE-2020-1147
High (7.8) in Microsoft .NET Framework, SharePoint, Visual Studio. In CISA KEV since 2021-11-03. EPSS 96% chance of exploitation in the next 30 days.
A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and Visual Studio when the software fails to check the source markup of XML file input, aka '.NET Framework, SharePoint Server, and Visual Studio Remote Code Execution Vulnerability'.
Severity
- EPSS
- 96% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
- CISA KEV
- listed 2021-11-03, due 2022-05-03
- Published
- Modified
- Record from
- the NVD, synced
Affected
- microsoft:.net_core
- microsoft:.net_framework
- microsoft:sharepoint_enterprise_server
- microsoft:sharepoint_server
- microsoft:visual_studio_2017
- microsoft:visual_studio_2019
References
- http://packetstormsecurity.com/files/158694/SharePoint-DataSet-DataTable-Deserialization.html
- http://packetstormsecurity.com/files/158876/Microsoft-SharePoint-Server-2019-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/163644/Microsoft-SharePoint-Server-2019-Remote-Code-Execution.html
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1147
- https://www.exploitalert.com/view-details.html?id=35992