Input validation error in Microsoft SharePoint Server - CVE-2020-1444
Published: July 14, 2020 / Updated: November 14, 2020
Vulnerability identifier: #VU29764
CSH Severity: High
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-1444
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
Public exploit is available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to insufficient validation of user-supplied input when the Microsoft SharePoint software improperly parses specially crafted email messages. A remote attacker can send a specially crafted email, then convince the recipient to perform multiple actions while replying to the message and execute arbitrary code on the target system.
Affected software
Microsoft SharePoint Server
How to mitigate CVE-2020-1444
Install updates from vendor's website.