CVE-2020-1147

EUVD-2022-3898
A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and Visual Studio when the software fails to check the source markup of XML file input, aka '.NET Framework, SharePoint Server, and Visual Studio Remote Code Execution Vulnerability'.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.8 HIGH
LOCAL
LOW
NONE
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CISA-ADPADP
7.8 HIGH
LOCAL
LOW
NONE
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 99%
Affected Products (NVD)
VendorProductVersion
microsoft.net_core
2.1
microsoft.net_core
3.1
microsoft.net_framework
2.0:sp2
microsoft.net_framework
3.0:sp2
microsoft.net_framework
3.5
microsoft.net_framework
3.5
microsoft.net_framework
4.6.2
microsoft.net_framework
4.7
microsoft.net_framework
4.7.1
microsoft.net_framework
4.7.2
microsoft.net_framework
3.5
microsoft.net_framework
4.6
microsoft.net_framework
4.6.1
microsoft.net_framework
4.6.2
microsoft.net_framework
3.5
microsoft.net_framework
4.6
microsoft.net_framework
4.6.1
microsoft.net_framework
4.6.2
microsoft.net_framework
3.5
microsoft.net_framework
4.7.1
microsoft.net_framework
4.7.2
microsoft.net_framework
3.5
microsoft.net_framework
4.7.2
microsoft.net_framework
3.5
microsoft.net_framework
4.8
microsoft.net_framework
3.5.1
microsoft.net_framework
4.5.2
microsoft.net_framework
4.6
microsoft.net_framework
4.6
microsoft.net_framework
4.6.1
microsoft.net_framework
4.6.2
microsoft.net_framework
4.7
microsoft.net_framework
4.7.1
microsoft.net_framework
4.7.2
microsoft.net_framework
4.8
microsoftvisual_studio_2017
15.0 ≤
𝑥
≤ 15.9
microsoftvisual_studio_2019
16.0 ≤
𝑥
≤ 16.6
𝑥
= Vulnerable software versions
Windows Releases
Platform
Version
Windows 10
(x64, x86)
KB4580327
1607 (x64, x86)
KB4580346
1607 (x64, x86)
KB4578969
1709 (arm64, x64, x86)
KB4580328
1709 (x64, x86)
KB4578971
1803 (arm64, x64, x86)
KB4580330
1803 (x64, x86)
KB4578972
1809 (arm64, x64, x64, x86, x86)
KB4579976
1903 (arm64, x64, x86)
KB4578974
1909 (arm64, x64, x86)
KB4578974
2004 (arm64, x64, x86)
KB4578968
Windows 7
Service Pack 1 (x64, x86)
KB4578963
Service Pack 1 (x64, x64, x64, x86, x86, x86)
KB4579977
Windows 8.1
(x64, x64, x64, x64, x86, x86, x86, x86)
KB4579979
(x64, x64, x86, x86)
KB4566468
Windows RT 8.1
All
KB4579979
Windows Server
1803 Server Core
KB4578972
1803 Server Core
KB4580330
1903 Server Core
KB4578974
1909 Server Core
KB4578974
2004 Server Core
KB4578968
Windows Server 2008
Service Pack 2 (x64, x86)
KB4578963
Service Pack 2 (x64, x64, x86, x86)
KB4579980
Windows Server 2008 R2
Service Pack 1 (x64)
KB4578963
Service Pack 1 (x64, x64, x64)
KB4579977
Service Pack 1 Server Core (x64)
KB4578963
Service Pack 1 Server Core (x64, x64)
KB4579977
Windows Server 2012
Server Core
KB4579978
Standard
KB4579978
Windows Server 2012 R2
Server Core
KB4579979
Server Core
KB4566468
Standard
KB4579979
Standard
KB4566468
Windows Server 2016
Server Core
KB4578969
Server Core
KB4580346
Standard
KB4578969
Standard
KB4580346
Windows Server 2019
Server Core
KB4579976
Standard
KB4579976
References
http://packetstormsecurity.com/files/158694/SharePoint-DataSet-DataTable-Deserialization.html
http://packetstormsecurity.com/files/158876/Microsoft-SharePoint-Server-2019-Remote-Code-Execution.html
http://packetstormsecurity.com/files/163644/Microsoft-SharePoint-Server-2019-Remote-Code-Execution.html
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1147
https://www.exploitalert.com/view-details.html?id=35992
http://packetstormsecurity.com/files/158694/SharePoint-DataSet-DataTable-Deserialization.html
http://packetstormsecurity.com/files/158876/Microsoft-SharePoint-Server-2019-Remote-Code-Execution.html
http://packetstormsecurity.com/files/163644/Microsoft-SharePoint-Server-2019-Remote-Code-Execution.html
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1147
https://www.exploitalert.com/view-details.html?id=35992
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-1147