PT-2020-2458 · Microsoft · Sharepoint Server+1

Published 2020-05-12 · Updated 2021-07-21 · CVE-2020-1069

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft SharePoint Server (affected versions not specified)

Description A remote code execution issue exists due to the failure to properly identify and filter unsafe ASP.Net web controls. This could allow an authenticated attacker to perform actions in the security context of the SharePoint application pool process by using a specially crafted page. The vulnerability is related to insufficient input validation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

NULL Pointer Dereference

Weakness Enumeration

CWE-476

CWE-20

Related Identifiers

BDU:2020-02469

CVE-2020-1069

Affected Products

Sharepoint Server

Sharepoint Foundation

References · 7

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1069 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-1069 · Security Note
• https://bdu.fstec.ru/vul/2020-02469 · Security Note
• https://osv.dev/vulnerability/CVE-2020-1069 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1069 · Security Note
• https://safe-surf.ru/specialists/bulletins-nkcki/650718 · Security Note
• https://nvidia.custhelp.com/app/answers/detail/a_id/5147 · Note