CVE-2020-1046

A remote code execution vulnerability exists when Microsoft .NET Framework processes input. An attacker who successfully exploited this vulnerability could take control of an affected system. To exploit the vulnerability, an attacker would need to be able to upload a specially crafted file to a web application. The security update addresses the vulnerability by correcting how .NET Framework processes input.

CVSS v3 7.8 HIGH
CVSS v2.0 9.3 HIGH

7.8^/10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

9.3^/10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitability : 8.6 / Impact : 10.0

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1046	Patch Vendor Advisory
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1046	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:a:microsoft:.net_framework:2.0:sp2:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_server_2008:sp2:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:a:microsoft:.net_framework:3.5:*:*:*:*:*:*:*

OR	cpe:2.3:o:microsoft:windows_10:-:::::::*
	cpe:2.3:o:microsoft:windows_10:1607:::::::*
	cpe:2.3:o:microsoft:windows_10:1709:::::::*
	cpe:2.3:o:microsoft:windows_10:1803:::::::*
	cpe:2.3:o:microsoft:windows_10:1903:::::::*
	cpe:2.3:o:microsoft:windows_10:1909:::::::*
	cpe:2.3:o:microsoft:windows_8.1:-:::::::*
	cpe:2.3:o:microsoft:windows_server_2012:-:::::::*
	cpe:2.3:o:microsoft:windows_server_2012:r2:::::::*
	cpe:2.3:o:microsoft:windows_server_2016:-:::::::*
	cpe:2.3:o:microsoft:windows_server_2016:1909:::::::*
	cpe:2.3:o:microsoft:windows_server_2016:2004:::::::*

Configuration 3 (hide)

AND

OR	cpe:2.3:a:microsoft:.net_framework:3.5:::::::*
	cpe:2.3:a:microsoft:.net_framework:4.7.2:::::::*

OR	cpe:2.3:o:microsoft:windows_10:1809:::::::*
	cpe:2.3:o:microsoft:windows_server_2019:-:::::::*

Configuration 4 (hide)

AND

cpe:2.3:a:microsoft:.net_framework:3.5.1:*:*:*:*:*:*:*

OR	cpe:2.3:o:microsoft:windows_7:-:sp1::::::
	cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:::::x64:*

History

21 Nov 2024, 05:09

Type	Values Removed	Values Added
References	~~() https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1046 - Patch, Vendor Advisory~~	() https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1046 - Patch, Vendor Advisory

19 Jan 2024, 00:15

Type	Values Removed	Values Added
Summary	<p>A remote code execution vulnerability exists when Microsoft .NET Framework processes input. An attacker who successfully exploited this vulnerability could take control of an affected system.</p> <p>To exploit the vulnerability, an attacker would need to be able to upload a specially crafted file to a web application.</p> <p>The security update addresses the vulnerability by correcting how .NET Framework processes input.</p>	A remote code execution vulnerability exists when Microsoft .NET Framework processes input. An attacker who successfully exploited this vulnerability could take control of an affected system. To exploit the vulnerability, an attacker would need to be able to upload a specially crafted file to a web application. The security update addresses the vulnerability by correcting how .NET Framework processes input.

04 Jan 2024, 02:15

Type	Values Removed	Values Added
Summary	~~A remote code execution vulnerability exists when Microsoft .NET Framework processes input, aka '.NET Framework Remote Code Execution Vulnerability'.~~	<p>A remote code execution vulnerability exists when Microsoft .NET Framework processes input. An attacker who successfully exploited this vulnerability could take control of an affected system.</p> <p>To exploit the vulnerability, an attacker would need to be able to upload a specially crafted file to a web application.</p> <p>The security update addresses the vulnerability by correcting how .NET Framework processes input.</p>

Information

Published : 2020-08-17 19:15

Updated : 2024-11-21 05:09

NVD link : CVE-2020-1046

Mitre link : CVE-2020-1046

CVE.ORG link : CVE-2020-1046

JSON object : View

Products Affected

microsoft

windows_10
windows_7
.net_framework
windows_8.1
windows_server_2016
windows_server_2019
windows_server_2012
windows_server_2008

CWE

NVD-CWE-noinfo

7.8 /10