NetSight
IP …
high7.8Known exploitedPublic exploit code

CVE-2020-1147

Microsoft .NET Framework, SharePoint, and Visual Studio Remote Code Execution Vulnerability

Exploited in the wild

This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2021-11-03. Federal due date: 2022-05-03.

Apply updates per vendor instructions.

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and Visual Studio when the software fails to check the source markup of XML file input, aka '.NET Framework, SharePoint Server, and Visual Studio Remote Code Execution Vulnerability'.

Affected products

VendorProductAffected versions
Microsoft.Net Core
Versions 2.1, 3.1
Microsoft.Net Framework
Versions 2.0, 3.0, 3.5, 4.6.2, 4.7, 4.7.1
MicrosoftSharepoint Enterprise Server
Versions 2013, 2016
MicrosoftSharepoint Server
Versions 2010, 2019
MicrosoftVisual Studio 2017
from 15.0 through 15.9
MicrosoftVisual Studio 2019
from 16.0 through 16.6

References