Skip to content
fr Sign in
8.5 High

CVE-2020-1576 A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source…

Description

<p>A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the SharePoint application pool and the SharePoint server farm account.</p> <p>Exploitation of this vulnerability requires that a user uploads a specially crafted SharePoint application package to an affected version of SharePoint.</p> <p>The security update addresses the vulnerability by correcting how SharePoint checks the source markup of application packages.</p>

Affected products and versions

Product Affected versions Fixed in
Microsoft SharePoint Enterprise Server 2016 16.0 16.0.0 → latest No fix stated
Microsoft SharePoint Enterprise Server 2013 Service Pack 1 15.0 15.0.0 → latest No fix stated
Microsoft SharePoint Server 2019 16.0 16.0.0 → latest No fix stated
Microsoft SharePoint Foundation 2010 Service Pack 2 13.0 13.0.0 → latest No fix stated
Microsoft SharePoint Foundation 2013 Service Pack 1 15.0 15.0.0 → latest No fix stated
Microsoft SharePoint Server 2010 Service Pack 2 13.0 13.0.0.0 → latest No fix stated

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Microsoft SharePoint Enterprise Server 2016

The 337 CVEs of Microsoft SharePoint Enterprise Server 2016 →
CVE-2026-97783 Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint… 8.1 High CVE-2026-69943 Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows… 8.8 High CVE-2026-62917 Improper input validation in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a… 4.6 Medium CVE-2026-62839 Insufficiently protected credentials in Microsoft Office SharePoint allows an authorized attacker to perform spoofing… 6.5 Medium
Track this CVE