CVE-2020-0646 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	9.8 CRITICAL	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA-ADP	ADP	9.8 CRITICAL	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 99%

Affected Products (NVD)

Vendor	Product	Version
microsoft	.net_framework	3.0:sp2
microsoft	.net_framework	3.5
microsoft	.net_framework	3.5
microsoft	.net_framework	4.6.2
microsoft	.net_framework	4.7
microsoft	.net_framework	4.7.1
microsoft	.net_framework	4.7.2
microsoft	.net_framework	3.5
microsoft	.net_framework	4.7.1
microsoft	.net_framework	4.7.2
microsoft	.net_framework	3.5
microsoft	.net_framework	4.7.2
microsoft	.net_framework	3.5
microsoft	.net_framework	4.8
microsoft	.net_framework	3.5.1
microsoft	.net_framework	4.5.2
microsoft	.net_framework	4.6
microsoft	.net_framework	4.6.2
microsoft	.net_framework	4.7
microsoft	.net_framework	4.7.1
microsoft	.net_framework	4.7.2
microsoft	.net_framework	4.6
microsoft	.net_framework	4.6.1
microsoft	.net_framework	4.6.2
microsoft	.net_framework	4.7
microsoft	.net_framework	4.7.1
microsoft	.net_framework	4.7.2
microsoft	.net_framework	4.8

𝑥

= Vulnerable software versions

Windows Releases

Platform

Version

Windows 10

(x64, x86)	KB4534306
1607 (x64, x86)	KB4532933
1607 (x64, x86)	KB4534271
1709 (x64, x86)	KB4532935
1709 (x64, x86)	KB4534276
1803 (x64, x86)	KB4534293
1803 (x64, x86)	KB4532936
1809 (x64, x64, x86, x86)	KB4535101
1903 (x64, x86)	KB4532938
1909 (x64, x86)	KB4532938

Windows 7

Service Pack 1 (x64, x64, x64, x64, x86, x86, x86, x86)

Windows 8.1

(x64, x64, x64, x64, x86, x86, x86, x86)

Windows RT 8.1

All

Windows Server

1803 Server Core	KB4532936
1803 Server Core	KB4534293
1903 Server Core	KB4532938
1909 Server Core	KB4532938

Windows Server 2008

Service Pack 2 (x64, x64, x64, x86, x86, x86)

Windows Server 2008 R2

Service Pack 1 (x64, x64, x64, x64)	KB4535102
Service Pack 1 Server Core (x64, x64, x64, x64)	KB4535102

Windows Server 2012

Server Core	KB4535103
Standard	KB4535103

Windows Server 2012 R2

Server Core	KB4535104
Standard	KB4535104

Windows Server 2016

Server Core	KB4532933
Server Core	KB4534271
Standard	KB4532933
Standard	KB4534271

Windows Server 2019

Server Core	KB4535101
Standard	KB4535101

Known Exploits!

Common Weakness Enumeration

CWE-91 - XML Injection (aka Blind XPath Injection)
The software does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.

References

http://packetstormsecurity.com/files/156930/SharePoint-Workflows-XOML-Injection.html

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0646

http://packetstormsecurity.com/files/156930/SharePoint-Workflows-XOML-Injection.html

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0646

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-0646