CVE-2020-1069: A remote code execution vulnerability exists in Microsoft SharePoint Server when it fails to properly identify and filter unsafe ASP.Net web controls. An…

PriorityP356high8.8CVSS 3.1

AVNACLPRLUINSUCHIHAH

EPSS

4.01%

90.5th percentile

A remote code execution vulnerability exists in Microsoft SharePoint Server when it fails to properly identify and filter unsafe ASP.Net web controls. An authenticated attacker who successfully exploited the vulnerability could use a specially crafted page to perform actions in the security context of the SharePoint application pool process. To exploit the vulnerability, an authenticated user must create and invoke a specially crafted page on an affected version of Microsoft SharePoint Server. The security update addresses the vulnerability by correcting how Microsoft SharePoint Server handles processing of created content.

Affected

9 ranges

Vendor	Product	Version range	Fixed in
microsoft	microsoft_sharepoint_enterprise_server_2016	>= 16.0.0 < publication	publication
microsoft	microsoft_sharepoint_foundation_2013_service_pack_1	>= 15.0.0 < publication	publication
microsoft	microsoft_sharepoint_server_2019	>= 16.0.0 < publication	publication
microsoft	sharepoint_enterprise_server	—	—
microsoft	sharepoint_foundation	—	—
microsoft	sharepoint_server	—	—
msrc	microsoft_sharepoint_enterprise_server_2016	—	—
msrc	microsoft_sharepoint_foundation_2013_service_pack_1	—	—
msrc	microsoft_sharepoint_server_2019	—	—

Detection & IOCsextracted from sources · hover to see the quote

→Exploitation requires an authenticated user to create and invoke a specially crafted page on an affected Microsoft SharePoint Server, targeting unsafe ASP.Net web controls ↗
→Successful exploitation executes code in the context of the SharePoint application pool process — monitor for anomalous process activity spawned from the SharePoint app pool identity ↗
→Attack vector is uploading a malicious page to SharePoint — monitor for unusual .aspx or web control file uploads by authenticated users to SharePoint servers ↗

·Vulnerability is in Microsoft SharePoint Server's failure to properly identify and filter unsafe ASP.Net web controls; patching is the primary remediation — no public exploit or active exploitation confirmed at time of disclosure ↗

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P

vendor_msrc8.8CRITICAL

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.