CVE-2020-0920: A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microsoft SharePoint Remote Code Execution Vu...

Summary

A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microsoft SharePoint Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0929, CVE-2020-0931, CVE-2020-0932, CVE-2020-0971, CV...

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
microsoft	sharepoint_enterprise_server	2016 `cpe:2.3:a:microsoft:sharepoint_enterprise_server:2016:::::::*`
microsoft	sharepoint_foundation	2010 2013 `cpe:2.3:a:microsoft:sharepoint_foundation:2010:sp2::::::`
microsoft	sharepoint_server	2019 `cpe:2.3:a:microsoft:sharepoint_server:2019:::::::*`

Original advisory text

A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microsoft SharePoint Remote Code Execution Vu...

A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microsoft SharePoint Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0929, CVE-2020-0931, CVE-2020-0932, CVE-2020-0971, CVE-2020-0974.

References

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0920 Patch Vendor Advisory