PT-2020-1327 · Microsoft · .Net Framework

Irsdl · Published 2020-01-14 · Updated 2026-03-10 · CVE-2020-0646

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft .NET Framework (affected versions not specified)

Description A remote code execution issue exists due to the Microsoft .NET Framework's failure to properly validate input. This could allow a remote attacker to execute arbitrary code by using a specially crafted file. Successful exploitation could enable an attacker to take control of an affected system, install programs, view, change, or delete data, or create new accounts with full user rights. Users with fewer user rights on the system may be less impacted than those operating with administrative user rights.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Weakness Enumeration

CWE-91

CWE-20

Related Identifiers

BDU:2020-00229

CVE-2020-0646

Affected Products

.Net Framework

References · 23

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/sharepoint_workflows_xoml.rb · Exploit
• 🔥 https://mdsec.co.uk/2020/01/code-injection-in-workflows-leading-to-sharepoint-rce-cve-2020-0646 · Exploit
• 🔥 https://exploit-db.com/exploits/48275 · Exploit
• 🔥 http://packetstormsecurity.com/files/156930/SharePoint-Workflows-XOML-Injection.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-0646 · Security Note
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0646 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-0646 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-0646 · Security Note
• https://bdu.fstec.ru/vul/2020-00229 · Security Note
• https://twitter.com/transilienceai/status/1938804776554373462 · Twitter Post
• https://t.me/defcon_news/42745 · Telegram Post
• https://twitter.com/transilienceai/status/1938804764156080283 · Twitter Post
• https://twitter.com/Hacxx76012/status/1947823034762424800 · Twitter Post
• https://t.me/cybersecuritytechnologies/862 · Telegram Post
• https://t.me/cvenotify/117797 · Telegram Post