<p>A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the SharePoint application pool and the SharePoint server farm account.</p>
<p>Exploitation of this vulnerability requires that a user uploads a specially crafted SharePoint application package to an affected version of SharePoint.</p>
<p>The security update addresses the vulnerability by correcting how SharePoint checks the source markup of application packages.</p>
References
| Link | Resource |
|---|---|
| http://packetstormsecurity.com/files/159612/Microsoft-SharePoint-SSI-ViewState-Remote-Code-Execution.html | Exploit Third Party Advisory |
| https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16952 | Patch Vendor Advisory |
| http://packetstormsecurity.com/files/159612/Microsoft-SharePoint-SSI-ViewState-Remote-Code-Execution.html | Exploit Third Party Advisory |
| https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16952 | Patch Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 05:07
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://packetstormsecurity.com/files/159612/Microsoft-SharePoint-SSI-ViewState-Remote-Code-Execution.html - Exploit, Third Party Advisory | |
| References | () https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16952 - Patch, Vendor Advisory |
31 Dec 2023, 20:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | <p>A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the SharePoint application pool and the SharePoint server farm account.</p> <p>Exploitation of this vulnerability requires that a user uploads a specially crafted SharePoint application package to an affected version of SharePoint.</p> <p>The security update addresses the vulnerability by correcting how SharePoint checks the source markup of application packages.</p> | |
| CVSS |
v2 : v3 : |
v2 : 6.8
v3 : 8.6 |
Information
Published : 2020-10-16 23:15
Updated : 2024-11-21 05:07
NVD link : CVE-2020-16952
Mitre link : CVE-2020-16952
CVE.ORG link : CVE-2020-16952
JSON object : View
Products Affected
microsoft
- sharepoint_server
- sharepoint_enterprise_server
- sharepoint_foundation
CWE
CWE-346
Origin Validation Error