CVE-2020-1147

Microsoft .NET Framework, SharePoint, and Visual Studio Remote Code Execution

7.8 HIGHActively exploited (CISA KEV)Public exploitEPSS 94.0%

Published14 Jul 2020
Added to CISA KEV3 Nov 2021
Remediation due3 May 2022

Description

A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and Visual Studio when the software fails to check the source markup of XML file input, aka '.NET Framework, SharePoint Server, and Visual Studio Remote Code Execution Vulnerability'.

CVSS 3.1 breakdown

Attack vectorLocal

Attack complexityLow

Privileges requiredNone

User interactionRequired

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

Microsoft .net Core2.1 · 3.1

Microsoft .net Framework2.0 · 3.0 · 3.5 · 3.5.1

Microsoft SharePoint Enterprise Server2013 · 2016

Microsoft SharePoint Server2010 · 2019

Microsoft Visual Studio 2017≥ 15.0 ≤ 15.9

Microsoft Visual Studio 2019≥ 16.0 ≤ 16.6

Remediation

No fixed version is recorded in the NVD data. Check the vendor advisory for the latest guidance.

Patch & vendor advisories

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1147

References

http://packetstormsecurity.com/files/158694/SharePoint-DataSet-DataTable-Deserialization.htmlExploitThird Party AdvisoryVDB Entry
http://packetstormsecurity.com/files/158876/Microsoft-SharePoint-Server-2019-Remote-Code-Execution.htmlExploitThird Party AdvisoryVDB Entry
http://packetstormsecurity.com/files/163644/Microsoft-SharePoint-Server-2019-Remote-Code-Execution.htmlExploitThird Party AdvisoryVDB Entry
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1147PatchVendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-1147US Government Resource
https://www.exploitalert.com/view-details.html?id=35992ExploitThird Party Advisory

Frequently asked

Is CVE-2020-1147 being actively exploited?

Yes. CVE-2020-1147 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 3 Nov 2021.

How severe is CVE-2020-1147?

CVE-2020-1147 has a CVSS 3.1 base score of 7.8, rated high. EPSS estimates a 94.0% probability of exploitation.

Which products are affected by CVE-2020-1147?

Affected products include Microsoft .net Core, Microsoft .net Framework, Microsoft SharePoint Enterprise Server, Microsoft SharePoint Server, Microsoft Visual Studio 2017, and 1 more.

How do I fix CVE-2020-1147?

Apply the vendor's patch or advisory guidance, then verify no affected versions remain across your devices.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2020-1147 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, a risk for it never ranks below high, and the update that fixes it moves to the Emergency patch lane. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo

Running Microsoft 365?

Patching is one half. Scan your domain and check MFA, legacy authentication, admin roles and mail forwarding in two minutes, with a fix for every gap.

Run the free Microsoft 365 check

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.