CVE-2020-1200 - Microsoft SharePoint Remote Code Execution Vulnerability

Back Back to CVE browser

HIGH

Microsoft SharePoint Remote Code Execution Vulnerability

Published Sep 11, 2020

8.6

HIGH

CVSS 3.1

EPSS 2.07%

Description

A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the SharePoint application pool and the SharePoint server farm account. Exploitation of this vulnerability requires that a user uploads a specially crafted SharePoint application package to an affected version of SharePoint. The security update addresses the vulnerability by correcting how SharePoint checks the source markup of application packages.

Affected products

Vendor Microsoft Product Microsoft SharePoint Enterprise Server 2016 Default
n/a
- Version
 16.0.0
 Status
 affected
 Constraints
 <publication
Vendor Microsoft Product Microsoft SharePoint Foundation 2010 Service Pack 2 Default
n/a
- Version
 13.0.0
 Status
 affected
 Constraints
 <publication
Vendor Microsoft Product Microsoft SharePoint Foundation 2013 Service Pack 1 Default
n/a
- Version
 15.0.0
 Status
 affected
 Constraints
 <publication
Vendor Microsoft Product Microsoft SharePoint Server 2019 Default
n/a
- Version
 16.0.0
 Status
 affected
 Constraints
 <publication

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Microsoft

Microsoft SharePoint Enterprise Server 2016

n/a

Version	Status	Constraints
16.0.0	affected	<publication

Microsoft

Microsoft SharePoint Foundation 2010 Service Pack 2

n/a

Version	Status	Constraints
13.0.0	affected	<publication

Microsoft

Microsoft SharePoint Foundation 2013 Service Pack 1

n/a

Version	Status	Constraints
15.0.0	affected	<publication

Microsoft

Microsoft SharePoint Server 2019

n/a

Version	Status	Constraints
16.0.0	affected	<publication

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-494

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-12080
Advisory
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1200
x_refsource_MISCPatchVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-12080		Advisory
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1200		x_refsource_MISCPatchVendor Advisory