CVE-2020-1460
Microsoft SharePoint Server Remote Code Execution Vulnerability
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
<p>A remote code execution vulnerability exists in Microsoft SharePoint Server when it fails to properly identify and filter unsafe ASP.Net web controls. An authenticated attacker who successfully exploited the vulnerability could use a specially crafted page to perform actions in the security context of the SharePoint application pool process.</p>
<p>To exploit the vulnerability, an authenticated user must create and invoke a specially crafted page on an affected version of Microsoft SharePoint Server.</p>
<p>The security update addresses the vulnerability by correcting how Microsoft SharePoint Server handles processing of created content.</p>
Se presenta una vulnerabilidad de ejecución de código remota en Microsoft SharePoint Server cuando presenta un fallo al identificar y filtrar correctamente los controles web ASP.Net no seguros, también se conoce como "Microsoft SharePoint Server Remote Code Execution Vulnerability"
CVSS Scores
SSVC
- Decision:-
Timeline
- 2019-11-04 CVE Reserved
- 2020-09-11 CVE Published
- 2024-01-30 EPSS Updated
- 2024-08-04 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
CAPEC
References (1)
| URL | Tag | Source |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1460 | 2023-12-31 |
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Microsoft Search vendor "Microsoft" | Sharepoint Enterprise Server Search vendor "Microsoft" for product "Sharepoint Enterprise Server" | 2013 Search vendor "Microsoft" for product "Sharepoint Enterprise Server" and version "2013" | sp1 |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Sharepoint Enterprise Server Search vendor "Microsoft" for product "Sharepoint Enterprise Server" | 2016 Search vendor "Microsoft" for product "Sharepoint Enterprise Server" and version "2016" | - |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Sharepoint Foundation Search vendor "Microsoft" for product "Sharepoint Foundation" | 2010 Search vendor "Microsoft" for product "Sharepoint Foundation" and version "2010" | sp2 |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Sharepoint Foundation Search vendor "Microsoft" for product "Sharepoint Foundation" | 2013 Search vendor "Microsoft" for product "Sharepoint Foundation" and version "2013" | sp1 |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Sharepoint Server Search vendor "Microsoft" for product "Sharepoint Server" | 2019 Search vendor "Microsoft" for product "Sharepoint Server" and version "2019" | - |
Affected
| ||||||