High severity · published Jul 14, 2020
CVE-2020-1147
Microsoft .NET Framework, SharePoint, and Visual Studio Remote Code Execution Vulnerability
In wildKEV
7.8
CVSS
94%
EPSS
Yes
On KEV
Description
A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and Visual Studio when the software fails to check the source markup of XML file input, aka '.NET Framework, SharePoint Server, and Visual Studio Remote Code Execution Vulnerability'.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)94.0% · higher than 100% of CVEs
Exploited in the wildYes
CISA KEVListed Nov 3, 2021
Federal remediation dueMay 3, 2022
Ransomware campaign useNot known
Affected products
Which versions
SH
SharePoint · Microsoft
2010; 2019 · source: NVD
NC
.NET Core · Microsoft
2.1; 3.1 · source: vendor, NVD
MN
Microsoft .NET Framework 2.0 · Microsoft
Service Pack 2 on Windows Server 2008 for 32-bit Systems Service Pack 2; Service Pack 2 on Windows Server 2008 for x64-based Systems Service Pack 2 · source: vendor
MN
Microsoft .NET Framework 3.0 · Microsoft
Service Pack 2 on Windows Server 2008 for 32-bit Systems Service Pack 2; Service Pack 2 on Windows Server 2008 for x64-based Systems Service Pack 2 · source: vendor
MN
Microsoft .NET Framework 3.5 · Microsoft
Windows 8.1 for 32-bit systems; Windows 8.1 for x64-based systems; Windows Server 2012; Windows Server 2012 (Server Core installation); Windows Server 2012 R2; Windows Server 2012 R2 (Server Core installation) · source: vendor
MN
Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows 10 Version 1607 for 32-bit Systems · Microsoft
All versions, or not specified · source: vendor
MN
Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows 10 Version 1607 for x64-based Systems · Microsoft
All versions, or not specified · source: vendor
MN
Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2016 · Microsoft
All versions, or not specified · source: vendor
MN
Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2016 (Server Core installation) · Microsoft
All versions, or not specified · source: vendor
MN
Microsoft .NET Framework 3.5 AND 4.6/4.6.1/4.6.2 on Windows 10 for 32-bit Systems · Microsoft
All versions, or not specified · source: vendor
MN
Microsoft .NET Framework 3.5 AND 4.6/4.6.1/4.6.2 on Windows 10 for x64-based Systems · Microsoft
All versions, or not specified · source: vendor
MN
Microsoft .NET Framework 3.5 AND 4.7.1/4.7.2 on Windows 10 Version 1709 for 32-bit Systems · Microsoft
All versions, or not specified · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-1147
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-1147
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
x_refsource_MISC
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1147
x_refsource_MISC
http://packetstormsecurity.com/files/158694/SharePoint-DataSet-DataTable-Deserialization.html
x_refsource_MISC
http://packetstormsecurity.com/files/158876/Microsoft-SharePoint-Server-2019-Remote-Code-Execution.html
x_refsource_MISC
https://www.exploitalert.com/view-details.html?id=35992
x_refsource_MISC
http://packetstormsecurity.com/files/163644/Microsoft-SharePoint-Server-2019-Remote-Code-Execution.html
More from SharePoint
9.8
CVE-2026-58644
Microsoft SharePoint Remote Code Execution Vulnerability
9.8
CVE-2026-50522
Microsoft SharePoint Remote Code Execution Vulnerability
9.8
CVE-2026-56164
Microsoft SharePoint Server Elevation of Privilege Vulnerability
9.8
CVE-2026-20963
Microsoft SharePoint Remote Code Execution Vulnerability
9.8
CVE-2025-53770
Microsoft SharePoint Server Remote Code Execution Vulnerability