Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.6
CVE-2020-1453: <p>A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package. An attacker who successfully exploited the vuln...
CVE-2020-1453 · published 6 years ago
Summary
<p>A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the SharePoint application pool and the SharePoint...
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| microsoft | sharepoint_enterprise_server |
2013 2016 cpe:2.3:a:microsoft:sharepoint_enterprise_server:2013:sp1:*:*:*:*:*:* |
| microsoft | sharepoint_foundation |
2010 2013 cpe:2.3:a:microsoft:sharepoint_foundation:2010:sp2:*:*:*:*:*:* |
| microsoft | sharepoint_server |
2019 cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:* |
Original advisory text
<p>A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package. An attacker who successfully exploited the vuln...
<p>A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the SharePoint application pool and the SharePoint server farm account.</p>
<p>Exploitation of this vulnerability requires that a user uploads a specially crafted SharePoint application package to an affected version of SharePoint.</p>
<p>The security update addresses the vulnerability by correcting how SharePoint checks the source markup of application packages.</p>
<p>Exploitation of this vulnerability requires that a user uploads a specially crafted SharePoint application package to an affected version of SharePoint.</p>
<p>The security update addresses the vulnerability by correcting how SharePoint checks the source markup of application packages.</p>
References
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1453 Patch Vendor Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-494Download of Code Without Integrity Check
Timeline
Published11 Sep 2020
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2020-1453 · NVD
Track software like this
Free during beta