Input validation error in Microsoft SharePoint Server - CVE-2020-1023
Published: May 12, 2020
Vulnerability identifier: #VU27725
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-1023
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package. A remote authenticated attacker can upload a specially crafted SharePoint application package and execute arbitrary code in the context of the SharePoint application pool and the SharePoint server farm account.
Affected software
Microsoft SharePoint Server
How to mitigate CVE-2020-1023
Install updates from vendor's website.