CVE-2020-1147
Summary
| CVE | CVE-2020-1147 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2020-07-14 23:15:00 UTC |
| Updated | 2022-07-12 17:42:00 UTC |
| Description | A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and Visual Studio when the software fails to check the source markup of XML file input, aka '.NET Framework, SharePoint Server, and Visual Studio Remote Code Execution Vulnerability'. |
Risk And Classification
EPSS: 0.942430000 probability, percentile 0.998400000 (date 2026-07-22)
CISA KEV: Listed on 2021-11-03; due 2022-05-03; ransomware use Unknown
Problem Types: NVD-CWE-Other
CISA Known Exploited Vulnerability
| Vendor | Microsoft |
|---|---|
| Product | .NET Framework, SharePoint, Visual Studio |
| Name | Microsoft .NET Framework, SharePoint, and Visual Studio Remote Code Execution Vulnerability |
| Required Action | Apply updates per vendor instructions. |
| Notes | https://nvd.nist.gov/vuln/detail/CVE-2020-1147 |
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Microsoft | .net Core | 2.1 | All | All | All |
| Application | Microsoft | .net Core | 3.1 | All | All | All |
| Application | Microsoft | .net Core | 2.1 | All | All | All |
| Application | Microsoft | .net Core | 3.1 | All | All | All |
| Application | Microsoft | .net Framework | 2.0 | sp2 | All | All |
| Application | Microsoft | .net Framework | 3.0 | sp2 | All | All |
| Application | Microsoft | .net Framework | 3.5 | All | All | All |
| Application | Microsoft | .net Framework | 3.5.1 | All | All | All |
| Application | Microsoft | .net Framework | 4.5.2 | All | All | All |
| Application | Microsoft | .net Framework | 4.6 | All | All | All |
| Application | Microsoft | .net Framework | 4.6.1 | All | All | All |
| Application | Microsoft | .net Framework | 4.6.2 | All | All | All |
| Application | Microsoft | .net Framework | 4.7 | All | All | All |
| Application | Microsoft | .net Framework | 4.7.1 | All | All | All |
| Application | Microsoft | .net Framework | 4.7.2 | All | All | All |
| Application | Microsoft | .net Framework | 4.8 | All | All | All |
| Application | Microsoft | .net Framework | 2.0 | sp2 | All | All |
| Application | Microsoft | .net Framework | 3.0 | sp2 | All | All |
| Application | Microsoft | .net Framework | 3.5 | All | All | All |
| Application | Microsoft | .net Framework | 3.5.1 | All | All | All |
| Application | Microsoft | .net Framework | 4.5.2 | All | All | All |
| Application | Microsoft | .net Framework | 4.6 | All | All | All |
| Application | Microsoft | .net Framework | 4.6.1 | All | All | All |
| Application | Microsoft | .net Framework | 4.6.2 | All | All | All |
| Application | Microsoft | .net Framework | 4.7 | All | All | All |
| Application | Microsoft | .net Framework | 4.7.1 | All | All | All |
| Application | Microsoft | .net Framework | 4.7.2 | All | All | All |
| Application | Microsoft | .net Framework | 4.8 | All | All | All |
| Application | Microsoft | Sharepoint Enterprise Server | 2013 | sp1 | All | All |
| Application | Microsoft | Sharepoint Enterprise Server | 2016 | All | All | All |
| Application | Microsoft | Sharepoint Enterprise Server | 2013 | sp1 | All | All |
| Application | Microsoft | Sharepoint Enterprise Server | 2016 | All | All | All |
| Application | Microsoft | Sharepoint Server | 2010 | sp2 | All | All |
| Application | Microsoft | Sharepoint Server | 2019 | All | All | All |
| Application | Microsoft | Sharepoint Server | 2010 | sp2 | All | All |
| Application | Microsoft | Sharepoint Server | 2019 | All | All | All |
| Application | Microsoft | Visual Studio 2017 | All | All | All | All |
| Application | Microsoft | Visual Studio 2019 | All | All | All | All |
| Operating System | Microsoft | Windows 10 | - | All | All | All |
| Operating System | Microsoft | Windows 10 | 1607 | All | All | All |
| Operating System | Microsoft | Windows 10 | 1709 | All | All | All |
| Operating System | Microsoft | Windows 10 | 1803 | All | All | All |
| Operating System | Microsoft | Windows 10 | 1809 | All | All | All |
| Operating System | Microsoft | Windows 10 | 1903 | All | All | All |
| Operating System | Microsoft | Windows 10 | 1909 | All | All | All |
| Operating System | Microsoft | Windows 10 | 2004 | All | All | All |
| Operating System | Microsoft | Windows 10 | - | All | All | All |
| Operating System | Microsoft | Windows 10 | 1607 | All | All | All |
| Operating System | Microsoft | Windows 10 | 1709 | All | All | All |
| Operating System | Microsoft | Windows 10 | 1803 | All | All | All |
| Operating System | Microsoft | Windows 10 | 1809 | All | All | All |
| Operating System | Microsoft | Windows 10 | 1903 | All | All | All |
| Operating System | Microsoft | Windows 10 | 1909 | All | All | All |
| Operating System | Microsoft | Windows 10 | 2004 | All | All | All |
| Operating System | Microsoft | Windows 7 | - | sp1 | All | All |
| Operating System | Microsoft | Windows 7 | - | sp1 | All | All |
| Operating System | Microsoft | Windows 8.1 | - | All | All | All |
| Operating System | Microsoft | Windows 8.1 | - | All | All | All |
| Operating System | Microsoft | Windows Rt 8.1 | - | All | All | All |
| Operating System | Microsoft | Windows Rt 8.1 | - | All | All | All |
| Operating System | Microsoft | Windows Server 2008 | - | sp2 | All | All |
| Operating System | Microsoft | Windows Server 2008 | r2 | sp1 | All | All |
| Operating System | Microsoft | Windows Server 2008 | r2 | sp1 | All | All |
| Operating System | Microsoft | Windows Server 2008 | - | sp2 | All | All |
| Operating System | Microsoft | Windows Server 2008 | r2 | sp1 | All | All |
| Operating System | Microsoft | Windows Server 2008 | r2 | sp1 | All | All |
| Operating System | Microsoft | Windows Server 2012 | - | All | All | All |
| Operating System | Microsoft | Windows Server 2012 | r2 | All | All | All |
| Operating System | Microsoft | Windows Server 2012 | - | All | All | All |
| Operating System | Microsoft | Windows Server 2012 | r2 | All | All | All |
| Operating System | Microsoft | Windows Server 2016 | - | All | All | All |
| Operating System | Microsoft | Windows Server 2016 | 1803 | All | All | All |
| Operating System | Microsoft | Windows Server 2016 | 1903 | All | All | All |
| Operating System | Microsoft | Windows Server 2016 | 1909 | All | All | All |
| Operating System | Microsoft | Windows Server 2016 | 2004 | All | All | All |
| Operating System | Microsoft | Windows Server 2016 | - | All | All | All |
| Operating System | Microsoft | Windows Server 2016 | 1803 | All | All | All |
| Operating System | Microsoft | Windows Server 2016 | 1903 | All | All | All |
| Operating System | Microsoft | Windows Server 2016 | 1909 | All | All | All |
| Operating System | Microsoft | Windows Server 2016 | 2004 | All | All | All |
| Operating System | Microsoft | Windows Server 2019 | - | All | All | All |
| Operating System | Microsoft | Windows Server 2019 | - | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| SharePoint DataSet / DataTable Deserialization ≈ Packet Storm | MISC | packetstormsecurity.com | |
| Microsoft SharePoint Server 2019 Remote Code Execution ≈ Packet Storm | MISC | packetstormsecurity.com | |
| Microsoft SharePoint Server 2019 Remote Code Execution ≈ Packet Storm | MISC | packetstormsecurity.com | |
| Microsoft SharePoint Server 2019 Remote Code Execution - Exploitalert | MISC | www.exploitalert.com | |
| portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1147 | MISC | portal.msrc.microsoft.com | Patch, Vendor Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
| CISA Known Exploited Vulnerabilities catalog | CISA | www.cisa.gov | kev |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.