Skip to content
fr Sign in
Not rated

CVE-2020-1024 A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source…

Description

A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the SharePoint application pool and the SharePoint server farm account. Exploitation of this vulnerability requires that a user uploads a specially crafted SharePoint application package to an affected version of SharePoint. The security update addresses the vulnerability by correcting how SharePoint checks the source markup of application packages.

Affected products and versions

Product Affected versions Fixed in
Microsoft SharePoint Enterprise Server 2016 No fix stated
Microsoft SharePoint Server 2019 No fix stated
Microsoft SharePoint Foundation Versions not published
Microsoft SharePoint Enterprise Server 2016 16.0 16.0.0 → latest No fix stated
Microsoft SharePoint Foundation 2013 Service Pack 1 15.0 15.0.0 → latest No fix stated
Microsoft SharePoint Server 2019 16.0 16.0.0 → latest No fix stated

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Microsoft SharePoint Enterprise Server

The 91 CVEs of Microsoft SharePoint Enterprise Server →
CVE-2020-1456 A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a… 5.4 Medium CVE-2020-1454 This vulnerability is caused when SharePoint Server does not properly sanitize a specially crafted request to an… 5.4 Medium CVE-2020-1451 A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a… 5.4 Medium CVE-2020-1450 A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a… 5.4 Medium
Track this CVE