CVE-2020-1069

CWE-476 — NULL Pointer Dereference CWE-119 — Buffer Overflow4 documents4 sources

Severity

8.8HIGH

EPSS

34.5%

top 3.00%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Microsoft Microsoft Sharepoint Enterprise Server Microsoft Microsoft Sharepoint Foundation Microsoft Microsoft Sharepoint Server +3 more

Timeline

PublishedMay 21

Latest updateMay 24

Description

A remote code execution vulnerability exists in Microsoft SharePoint Server when it fails to properly identify and filter unsafe ASP.Net web controls, aka 'Microsoft SharePoint Server Remote Code Execution Vulnerability'.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages6 packages

▶NVDmicrosoft/sharepoint_server2019

▶CVEListV5microsoft/microsoft_sharepoint_server2019

▶NVDmicrosoft/sharepoint_enterprise_server2016

▶CVEListV5microsoft/microsoft_sharepoint_enterprise_server2016

▶NVDmicrosoft/sharepoint_foundation2013

Patches

Patch: portal.msrc.microsoft.com ↗Patch: portal.msrc.microsoft.com ↗

🔴Vulnerability Details

GHSA

GHSA-hgfm-gjhm-cx48: A remote code execution vulnerability exists in Microsoft SharePoint Server when it fails to properly identify and filter unsafe ASP↗2022-05-24

▶

CVEList

CVE-2020-1069: A remote code execution vulnerability exists in Microsoft SharePoint Server when it fails to properly identify and filter unsafe ASP↗2020-05-21

▶

📋Vendor Advisories

Microsoft

Microsoft SharePoint Server Remote Code Execution Vulnerability↗2020-05-12

▶