Main Vulnerability Database Vulnerabilities #VU27736

Input validation error in Microsoft SharePoint Server - CVE-2020-1102

Published: May 12, 2020 / Updated: June 3, 2020

Vulnerability identifier: #VU27736

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-1102

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: Public exploit is available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists in Microsoft SharePoint when handling shared forms. A remote authenticated attacker can invoke a shared form in a way that allows arbitrary controls to be instantiated and execute arbitrary code in the context of the SharePoint application pool and the SharePoint server farm account.

Affected software

Microsoft SharePoint Server

How to mitigate CVE-2020-1102

Install updates from vendor's website.

Links to Public Exploits and PoC-codes

Exploit #2960 - snyk-js-jquery-565129 (patches for SNYK-JS-JQUERY-565129, SNYK-JS-JQUERY-567880, CVE-2020-1102, CVE-2020-11023, includes the patches for SNYK-JS-JQUERY-174006, CVE-2019-11358, CVE-2019-5428) (June 3, 2020)

External References

Related Security Bulletins

Multiple vulnerabilities in Microsoft SharePoint