Skip to content
fr Sign in
Not rated

CVE-2020-1069 A remote code execution vulnerability exists in Microsoft SharePoint Server when it fails to properly identify and…

Description

A remote code execution vulnerability exists in Microsoft SharePoint Server when it fails to properly identify and filter unsafe ASP.Net web controls. An authenticated attacker who successfully exploited the vulnerability could use a specially crafted page to perform actions in the security context of the SharePoint application pool process. To exploit the vulnerability, an authenticated user must create and invoke a specially crafted page on an affected version of Microsoft SharePoint Server. The security update addresses the vulnerability by correcting how Microsoft SharePoint Server handles processing of created content.

Affected products and versions

Product Affected versions Fixed in
Microsoft SharePoint Enterprise Server 2016 No fix stated
Microsoft SharePoint Server 2019 No fix stated
Microsoft SharePoint Foundation Versions not published
Microsoft SharePoint Enterprise Server 2016 16.0 16.0.0 → latest No fix stated
Microsoft SharePoint Foundation 2013 Service Pack 1 15.0 15.0.0 → latest No fix stated
Microsoft SharePoint Server 2019 16.0 16.0.0 → latest No fix stated

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Microsoft SharePoint Enterprise Server

The 91 CVEs of Microsoft SharePoint Enterprise Server →
CVE-2020-1456 A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a… 5.4 Medium CVE-2020-1454 This vulnerability is caused when SharePoint Server does not properly sanitize a specially crafted request to an… 5.4 Medium CVE-2020-1451 A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a… 5.4 Medium CVE-2020-1450 A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a… 5.4 Medium
Track this CVE