CVE-2020-1147: .NET Framework, SharePoint Server, and Visual Studio Remote Code Execution Vulnerability
Summary
CVE-2020-1147: .NET Framework, SharePoint Server, and Visual Studio Remote Code Execution Vulnerability. Affects Microsoft.NETCore.App versions >= 2.1.0, < 2.1.20. Fixed in 2.1.20. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The .NET Framework is a software framework developed by Microsoft that provides a runtime environment for building and running applications. It includes a large class library known as the Framework Class Library (FCL) and provides language interoperability across several programming languages. Microsoft SharePoint is a web-based collaborative platform that integrates with Microsoft Office. It is commonly used for document management and storage, team collaboration, and workflow automation. Visual Studio is an integrated development environment (IDE) used to develop computer programs, websites, web applications, and mobile applications. These software packages are widely used in various industries and are critical components of many applications.
Vulnerability Detail
A remote code execution vulnerability has been identified in the .NET Framework, Microsoft SharePoint, and Visual Studio. The vulnerability occurs when the software fails to properly validate the source markup of XML file input. This can allow an attacker to execute arbitrary code on the affected system, potentially leading to unauthorized access, data breaches, or system compromise. The vulnerability has been assigned the CVE identifier CVE-2020-1147 and has a CVSS score of 7.8, indicating a high severity level.
How To Fix
Minimum fixed version
2.1.20
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the official patches or updates provided by the software vendors to mitigate the risk.
Conclusion
In conclusion, a remote code execution vulnerability has been identified in the .NET Framework, Microsoft SharePoint, and Visual Studio. This vulnerability can allow an attacker to execute arbitrary code on the affected system, potentially leading to unauthorized access, data breaches, or system compromise. It is crucial to update the affected software packages to the fixed versions provided by the software vendors to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Microsoft.NETCore.App →
FAQ
The vulnerability can allow an attacker to execute arbitrary code on the affected system, potentially leading to unauthorized access, data breaches, or system compromise.
The vulnerability affects the .NET Framework, Microsoft SharePoint, and Visual Studio.
The CVSS score of this vulnerability is 7.8, indicating a high severity level.
There is no known workaround for this vulnerability. It is recommended to apply the official patches or updates provided by the software vendors.
To protect your system, it is recommended to update the affected software packages to the fixed versions as soon as possible.
Related vulnerabilities
Recent vulnerabilities recorded for Microsoft.NETCore.App.
