CVE-2020-1147
.NET Framework, SharePoint Server, and Visual Studio Remote Code Execution Vulnerability
7.8 HighIn KEVPublic exploitFix available
A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and Visual Studio when the software fails to check the source markup of XML file input, aka '.NET Framework, SharePoint Server, and Visual Studio Remote Code Execution Vulnerability'.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
95.8%Up 6.0 points since Apr 14, 2021
What each source reports
NVD Score used
A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and Visual Studio when the software fails to check the source markup of XML file input, aka '.NET Framework, SharePoint Server, and Visual Studio Remote Code Execution Vulnerability'.
- Record
CVE-2020-1147- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List
A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and Visual Studio when the software fails to check the source markup of XML file input, aka '.NET Framework, SharePoint Server, and Visual Studio Remote Code Execution Vulnerability'.
- Record
CVE-2020-1147- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
EUVDEUVD-2022-3898
A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and Visual Studio when the software fails to check the source markup of XML file input, aka '.NET Framework, SharePoint Server, and Visual Studio Remote Code Execution Vulnerability'.
- Record
EUVD-2022-3898- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-g5vf-38cp-4px9
.NET Framework, SharePoint Server, and Visual Studio Remote Code Execution Vulnerability
A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and Visual Studio when the software fails to check the source markup of XML file input, aka '.NET Framework, SharePoint Server, and Visual Studio Remote Code Execution Vulnerability'.
- Record
GHSA-g5vf-38cp-4px9- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:H - Updated
- 2026-11-02
CISA KEV No score
Microsoft .NET Framework, SharePoint, and Visual Studio Remote Code Execution Vulnerability
Microsoft .NET Framework, Microsoft SharePoint, and Visual Studio contain a remote code execution vulnerability when the software fails to check the source markup of XML file input. Successful exploitation allows an attacker to execute code in the context of the process responsible for deserialization of the XML content.
- Record
CVE-2020-1147- Updated
- 2026-11-02
OSV
A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and Visual Studio when the software fails to check the source markup of XML file input, aka '.NET Framework, SharePoint Server, and Visual Studio Remote Code Execution Vulnerability'.
- Record
CVE-2020-1147- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 7 moreShow less
OSVGHSA-g5vf-38cp-4px9
.NET Framework, SharePoint Server, and Visual Studio Remote Code Execution Vulnerability
A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and Visual Studio when the software fails to check the source markup of XML file input, aka '.NET Framework, SharePoint Server, and Visual Studio Remote Code Execution Vulnerability'.
- Record
GHSA-g5vf-38cp-4px9- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:H - Updated
- 2026-11-02
OSVRHSA-2020:2937
Red Hat Security Advisory: .NET Core 2.1 on Red Hat Enterprise Linux security and bugfix update
- Record
RHSA-2020:2937- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2020:2938
Red Hat Security Advisory: .NET Core security and bugfix update
- Record
RHSA-2020:2938- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2020:2939
Red Hat Security Advisory: .NET Core 3.1 on Red Hat Enterprise Linux security and bugfix update
- Record
RHSA-2020:2939- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2020:2954
Red Hat Security Advisory: .NET Core 3.1 security and bugfix update
- Record
RHSA-2020:2954- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2020:2988
Red Hat Security Advisory: .NET Core security and bugfix update
- Record
RHSA-2020:2988- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2020:2989
Red Hat Security Advisory: .NET Core security update
- Record
RHSA-2020:2989- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
- microsoft .net framework
- microsoft sharepoint server
- microsoft .net core
- microsoft .net framework, sharepoint, visual studio
- microsoft .net framework 2.0
- microsoft .net framework 3.0
- microsoft .net framework 3.5
- microsoft .net framework 3.5 and 4.6.2/4.7/4.7.1/4.7.2 on windows 10 version 1607 for 32-bit systems
- microsoft .net framework 3.5 and 4.6.2/4.7/4.7.1/4.7.2 on windows 10 version 1607 for x64-based systems
- microsoft .net framework 3.5 and 4.6.2/4.7/4.7.1/4.7.2 on windows server 2016
- microsoft .net framework 3.5 and 4.6.2/4.7/4.7.1/4.7.2 on windows server 2016 (server core installation)
- microsoft .net framework 3.5 and 4.6/4.6.1/4.6.2 on windows 10 for 32-bit systems
Show 59 moreShow less
- microsoft .net framework 3.5 and 4.6/4.6.1/4.6.2 on windows 10 for x64-based systems
- microsoft .net framework 3.5 and 4.7.1/4.7.2 on windows 10 version 1709 for 32-bit systems
- microsoft .net framework 3.5 and 4.7.1/4.7.2 on windows 10 version 1709 for arm64-based systems
- microsoft .net framework 3.5 and 4.7.1/4.7.2 on windows 10 version 1709 for x64-based systems
- microsoft .net framework 3.5 and 4.7.2 on windows 10 version 1803 for 32-bit systems
- microsoft .net framework 3.5 and 4.7.2 on windows 10 version 1803 for arm64-based systems
- microsoft .net framework 3.5 and 4.7.2 on windows 10 version 1803 for x64-based systems
- microsoft .net framework 3.5 and 4.7.2 on windows 10 version 1809 for 32-bit systems
- microsoft .net framework 3.5 and 4.7.2 on windows 10 version 1809 for arm64-based systems
- microsoft .net framework 3.5 and 4.7.2 on windows 10 version 1809 for x64-based systems
- microsoft .net framework 3.5 and 4.7.2 on windows server 2019
- microsoft .net framework 3.5 and 4.7.2 on windows server 2019 (server core installation)
- microsoft .net framework 3.5 and 4.7.2 on windows server, version 1803 (server core installation)
- microsoft .net framework 3.5 and 4.8 on windows 10 version 1809 for 32-bit systems
- microsoft .net framework 3.5 and 4.8 on windows 10 version 1809 for x64-based systems
- microsoft .net framework 3.5 and 4.8 on windows 10 version 1903 for 32-bit systems
- microsoft .net framework 3.5 and 4.8 on windows 10 version 1903 for arm64-based systems
- microsoft .net framework 3.5 and 4.8 on windows 10 version 1903 for x64-based systems
- microsoft .net framework 3.5 and 4.8 on windows 10 version 1909 for 32-bit systems
- microsoft .net framework 3.5 and 4.8 on windows 10 version 1909 for arm64-based systems
- microsoft .net framework 3.5 and 4.8 on windows 10 version 1909 for x64-based systems
- microsoft .net framework 3.5 and 4.8 on windows 10 version 2004 for 32-bit systems
- microsoft .net framework 3.5 and 4.8 on windows 10 version 2004 for arm64-based systems
- microsoft .net framework 3.5 and 4.8 on windows 10 version 2004 for x64-based systems
- microsoft .net framework 3.5 and 4.8 on windows server 2019
- microsoft .net framework 3.5 and 4.8 on windows server 2019 (server core installation)
- microsoft .net framework 3.5 and 4.8 on windows server, version 1903 (server core installation)
- microsoft .net framework 3.5 and 4.8 on windows server, version 1909 (server core installation)
- microsoft .net framework 3.5 and 4.8 on windows server, version 2004 (server core installation)
- microsoft .net framework 3.5.1
- microsoft .net framework 4.5.2
- microsoft .net framework 4.6
- microsoft .net framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2
- microsoft .net framework 4.8 on windows 10 version 1607 for 32-bit systems
- microsoft .net framework 4.8 on windows 10 version 1607 for x64-based systems
- microsoft .net framework 4.8 on windows 10 version 1709 for 32-bit systems
- microsoft .net framework 4.8 on windows 10 version 1709 for x64-based systems
- microsoft .net framework 4.8 on windows 10 version 1803 for 32-bit systems
- microsoft .net framework 4.8 on windows 10 version 1803 for x64-based systems
- microsoft .net framework 4.8 on windows 7 for 32-bit systems service pack 1
- microsoft .net framework 4.8 on windows 7 for x64-based systems service pack 1
- microsoft .net framework 4.8 on windows 8.1 for 32-bit systems
- microsoft .net framework 4.8 on windows 8.1 for x64-based systems
- microsoft .net framework 4.8 on windows rt 8.1
- microsoft .net framework 4.8 on windows server 2008 r2 for x64-based systems service pack 1
- microsoft .net framework 4.8 on windows server 2008 r2 for x64-based systems service pack 1 (server core installation)
- microsoft .net framework 4.8 on windows server 2012
- microsoft .net framework 4.8 on windows server 2012 (server core installation)
- microsoft .net framework 4.8 on windows server 2012 r2
- microsoft .net framework 4.8 on windows server 2012 r2 (server core installation)
- microsoft .net framework 4.8 on windows server 2016
- microsoft .net framework 4.8 on windows server 2016 (server core installation)
- microsoft .net framework 4.8 on windows server, version 1803 (server core installation)
- microsoft sharepoint enterprise server
- microsoft visual studio 2017 version 15.9 (includes 15.0 - 15.8)
- microsoft visual studio 2019
- microsoft visual studio 2019 version 16.4 (includes 16.0 - 16.3)
- microsoft visual studio 2019 version 16.6 (includes 16.0 - 16.5)
- microsoft visual studio 2017
Affected packages
| Package | Affected | Fixed |
|---|---|---|
Microsoft.NETCore.AppNuGet |
2.1.0 up to 2.1.20 | 2.1.20 |
Microsoft.NETCore.App.Runtime.linux-armNuGet |
3.1.0 up to 3.1.6 | 3.1.6 |
Microsoft.NETCore.App.Runtime.linux-arm64NuGet |
3.1.0 up to 3.1.6 | 3.1.6 |
Microsoft.NETCore.App.Runtime.linux-musl-arm64NuGet |
3.1.0 up to 3.1.6 | 3.1.6 |
Microsoft.NETCore.App.Runtime.linux-musl-x64NuGet |
3.1.0 up to 3.1.6 | 3.1.6 |
Microsoft.NETCore.App.Runtime.linux-x64NuGet |
3.1.0 up to 3.1.6 | 3.1.6 |
Microsoft.NETCore.App.Runtime.osx-x64NuGet |
3.1.0 up to 3.1.6 | 3.1.6 |
Microsoft.NETCore.App.Runtime.rhel.6-x64NuGet |
3.1.0 up to 3.1.6 | 3.1.6 |
Microsoft.NETCore.App.Runtime.win-armNuGet |
3.1.0 up to 3.1.6 | 3.1.6 |
Microsoft.NETCore.App.Runtime.win-arm64NuGet |
3.1.0 up to 3.1.6 | 3.1.6 |
Show 85 moreShow less
| Package | Affected | Fixed |
|---|---|---|
Microsoft.NETCore.App.Runtime.win-x64NuGet |
3.1.0 up to 3.1.6 | 3.1.6 |
Microsoft.NETCore.App.Runtime.win-x86NuGet |
3.1.0 up to 3.1.6 | 3.1.6 |
Microsoft.NETCore.AppNuGet |
2.1.0 up to 2.1.20, plus listed versions 2.1.12.1.102.1.112.1.122.1.13 Show 14 moreShow less2.1.142.1.152.1.162.1.172.1.182.1.192.1.22.1.32.1.42.1.52.1.62.1.72.1.82.1.9 |
2.1.20 |
Microsoft.NETCore.App.Runtime.linux-armNuGet |
3.1.0 up to 3.1.6, plus listed versions 3.1.13.1.23.1.33.1.43.1.5 |
3.1.6 |
Microsoft.NETCore.App.Runtime.linux-arm64NuGet |
3.1.0 up to 3.1.6, plus listed versions 3.1.13.1.23.1.33.1.43.1.5 |
3.1.6 |
Microsoft.NETCore.App.Runtime.linux-musl-arm64NuGet |
3.1.0 up to 3.1.6, plus listed versions 3.1.13.1.23.1.33.1.43.1.5 |
3.1.6 |
Microsoft.NETCore.App.Runtime.linux-musl-x64NuGet |
3.1.0 up to 3.1.6, plus listed versions 3.1.13.1.23.1.33.1.43.1.5 |
3.1.6 |
Microsoft.NETCore.App.Runtime.linux-x64NuGet |
3.1.0 up to 3.1.6, plus listed versions 3.1.13.1.23.1.33.1.43.1.5 |
3.1.6 |
Microsoft.NETCore.App.Runtime.osx-x64NuGet |
3.1.0 up to 3.1.6, plus listed versions 3.1.13.1.23.1.33.1.43.1.5 |
3.1.6 |
Microsoft.NETCore.App.Runtime.rhel.6-x64NuGet |
3.1.0 up to 3.1.6, plus listed versions 3.1.13.1.23.1.33.1.43.1.5 |
3.1.6 |
Microsoft.NETCore.App.Runtime.win-armNuGet |
3.1.0 up to 3.1.6, plus listed versions 3.1.13.1.23.1.33.1.43.1.5 |
3.1.6 |
Microsoft.NETCore.App.Runtime.win-arm64NuGet |
3.1.0 up to 3.1.6, plus listed versions 3.1.13.1.23.1.33.1.43.1.5 |
3.1.6 |
Microsoft.NETCore.App.Runtime.win-x64NuGet |
3.1.0 up to 3.1.6, plus listed versions 3.1.13.1.23.1.33.1.43.1.5 |
3.1.6 |
Microsoft.NETCore.App.Runtime.win-x86NuGet |
3.1.0 up to 3.1.6, plus listed versions 3.1.13.1.23.1.33.1.43.1.5 |
3.1.6 |
rh-dotnet21Red Hat:rhel_dotnet:2.1::el7 |
before 0:2.1-19.el7 | 0:2.1-19.el7 |
rh-dotnet21-dotnetRed Hat:rhel_dotnet:2.1::el7 |
before 0:2.1.516-1.el7 | 0:2.1.516-1.el7 |
rh-dotnet21-dotnet-debuginfoRed Hat:rhel_dotnet:2.1::el7 |
before 0:2.1.516-1.el7 | 0:2.1.516-1.el7 |
rh-dotnet21-dotnet-hostRed Hat:rhel_dotnet:2.1::el7 |
before 0:2.1.20-1.el7 | 0:2.1.20-1.el7 |
rh-dotnet21-dotnet-runtime-2.1Red Hat:rhel_dotnet:2.1::el7 |
before 0:2.1.20-1.el7 | 0:2.1.20-1.el7 |
rh-dotnet21-dotnet-sdk-2.1Red Hat:rhel_dotnet:2.1::el7 |
before 0:2.1.516-1.el7 | 0:2.1.516-1.el7 |
rh-dotnet21-dotnet-sdk-2.1.5xxRed Hat:rhel_dotnet:2.1::el7 |
before 0:2.1.516-1.el7 | 0:2.1.516-1.el7 |
rh-dotnet21-runtimeRed Hat:rhel_dotnet:2.1::el7 |
before 0:2.1-19.el7 | 0:2.1-19.el7 |
dotnetRed Hat:enterprise_linux:8::appstream |
before 0:2.1.516-1.el8_2 | 0:2.1.516-1.el8_2 |
dotnet-debuginfoRed Hat:enterprise_linux:8::appstream |
before 0:2.1.516-1.el8_2 | 0:2.1.516-1.el8_2 |
dotnet-debugsourceRed Hat:enterprise_linux:8::appstream |
before 0:2.1.516-1.el8_2 | 0:2.1.516-1.el8_2 |
dotnet-host-fxr-2.1Red Hat:enterprise_linux:8::appstream |
before 0:2.1.20-1.el8_2 | 0:2.1.20-1.el8_2 |
dotnet-host-fxr-2.1-debuginfoRed Hat:enterprise_linux:8::appstream |
before 0:2.1.20-1.el8_2 | 0:2.1.20-1.el8_2 |
dotnet-runtime-2.1Red Hat:enterprise_linux:8::appstream |
before 0:2.1.20-1.el8_2 | 0:2.1.20-1.el8_2 |
dotnet-runtime-2.1-debuginfoRed Hat:enterprise_linux:8::appstream |
before 0:2.1.20-1.el8_2 | 0:2.1.20-1.el8_2 |
dotnet-sdk-2.1Red Hat:enterprise_linux:8::appstream |
before 0:2.1.516-1.el8_2 | 0:2.1.516-1.el8_2 |
dotnet-sdk-2.1.5xxRed Hat:enterprise_linux:8::appstream |
before 0:2.1.516-1.el8_2 | 0:2.1.516-1.el8_2 |
dotnet-sdk-2.1.5xx-debuginfoRed Hat:enterprise_linux:8::appstream |
before 0:2.1.516-1.el8_2 | 0:2.1.516-1.el8_2 |
rh-dotnet31-aspnetcore-runtime-3.1Red Hat:rhel_dotnet:3.1::el7 |
before 0:3.1.6-1.el7 | 0:3.1.6-1.el7 |
rh-dotnet31-aspnetcore-targeting-pack-3.1Red Hat:rhel_dotnet:3.1::el7 |
before 0:3.1.6-1.el7 | 0:3.1.6-1.el7 |
rh-dotnet31-dotnetRed Hat:rhel_dotnet:3.1::el7 |
before 0:3.1.106-1.el7 | 0:3.1.106-1.el7 |
rh-dotnet31-dotnet-apphost-pack-3.1Red Hat:rhel_dotnet:3.1::el7 |
before 0:3.1.6-1.el7 | 0:3.1.6-1.el7 |
rh-dotnet31-dotnet-debuginfoRed Hat:rhel_dotnet:3.1::el7 |
before 0:3.1.106-1.el7 | 0:3.1.106-1.el7 |
rh-dotnet31-dotnet-hostRed Hat:rhel_dotnet:3.1::el7 |
before 0:3.1.6-1.el7 | 0:3.1.6-1.el7 |
rh-dotnet31-dotnet-hostfxr-3.1Red Hat:rhel_dotnet:3.1::el7 |
before 0:3.1.6-1.el7 | 0:3.1.6-1.el7 |
rh-dotnet31-dotnet-runtime-3.1Red Hat:rhel_dotnet:3.1::el7 |
before 0:3.1.6-1.el7 | 0:3.1.6-1.el7 |
rh-dotnet31-dotnet-sdk-3.1Red Hat:rhel_dotnet:3.1::el7 |
before 0:3.1.106-1.el7 | 0:3.1.106-1.el7 |
rh-dotnet31-dotnet-targeting-pack-3.1Red Hat:rhel_dotnet:3.1::el7 |
before 0:3.1.6-1.el7 | 0:3.1.6-1.el7 |
rh-dotnet31-dotnet-templates-3.1Red Hat:rhel_dotnet:3.1::el7 |
before 0:3.1.106-1.el7 | 0:3.1.106-1.el7 |
rh-dotnet31-netstandard-targeting-pack-2.1Red Hat:rhel_dotnet:3.1::el7 |
before 0:3.1.106-1.el7 | 0:3.1.106-1.el7 |
aspnetcore-runtime-3.1Red Hat:enterprise_linux:8::appstream |
before 0:3.1.6-1.el8_2 | 0:3.1.6-1.el8_2 |
aspnetcore-targeting-pack-3.1Red Hat:enterprise_linux:8::appstream |
before 0:3.1.6-1.el8_2 | 0:3.1.6-1.el8_2 |
dotnetRed Hat:enterprise_linux:8::appstream |
before 0:3.1.106-1.el8_2 | 0:3.1.106-1.el8_2 |
dotnet-apphost-pack-3.1Red Hat:enterprise_linux:8::appstream |
before 0:3.1.6-1.el8_2 | 0:3.1.6-1.el8_2 |
dotnet-apphost-pack-3.1-debuginfoRed Hat:enterprise_linux:8::appstream |
before 0:3.1.6-1.el8_2 | 0:3.1.6-1.el8_2 |
dotnet-hostRed Hat:enterprise_linux:8::appstream |
before 0:3.1.6-1.el8_2 | 0:3.1.6-1.el8_2 |
dotnet-host-debuginfoRed Hat:enterprise_linux:8::appstream |
before 0:3.1.6-1.el8_2 | 0:3.1.6-1.el8_2 |
dotnet-hostfxr-3.1Red Hat:enterprise_linux:8::appstream |
before 0:3.1.6-1.el8_2 | 0:3.1.6-1.el8_2 |
dotnet-hostfxr-3.1-debuginfoRed Hat:enterprise_linux:8::appstream |
before 0:3.1.6-1.el8_2 | 0:3.1.6-1.el8_2 |
dotnet-runtime-3.1Red Hat:enterprise_linux:8::appstream |
before 0:3.1.6-1.el8_2 | 0:3.1.6-1.el8_2 |
dotnet-runtime-3.1-debuginfoRed Hat:enterprise_linux:8::appstream |
before 0:3.1.6-1.el8_2 | 0:3.1.6-1.el8_2 |
dotnet-sdk-3.1Red Hat:enterprise_linux:8::appstream |
before 0:3.1.106-1.el8_2 | 0:3.1.106-1.el8_2 |
dotnet-sdk-3.1-debuginfoRed Hat:enterprise_linux:8::appstream |
before 0:3.1.106-1.el8_2 | 0:3.1.106-1.el8_2 |
dotnet-targeting-pack-3.1Red Hat:enterprise_linux:8::appstream |
before 0:3.1.6-1.el8_2 | 0:3.1.6-1.el8_2 |
dotnet-templates-3.1Red Hat:enterprise_linux:8::appstream |
before 0:3.1.106-1.el8_2 | 0:3.1.106-1.el8_2 |
dotnet3.1Red Hat:enterprise_linux:8::appstream |
before 0:3.1.106-1.el8_2 | 0:3.1.106-1.el8_2 |
dotnet3.1-debuginfoRed Hat:enterprise_linux:8::appstream |
before 0:3.1.106-1.el8_2 | 0:3.1.106-1.el8_2 |
dotnet3.1-debugsourceRed Hat:enterprise_linux:8::appstream |
before 0:3.1.106-1.el8_2 | 0:3.1.106-1.el8_2 |
netstandard-targeting-pack-2.1Red Hat:enterprise_linux:8::appstream |
before 0:3.1.106-1.el8_2 | 0:3.1.106-1.el8_2 |
dotnetRed Hat:rhel_eus:8.1::appstream |
before 0:2.1.516-1.el8_1 | 0:2.1.516-1.el8_1 |
dotnet-debuginfoRed Hat:rhel_eus:8.1::appstream |
before 0:2.1.516-1.el8_1 | 0:2.1.516-1.el8_1 |
dotnet-debugsourceRed Hat:rhel_eus:8.1::appstream |
before 0:2.1.516-1.el8_1 | 0:2.1.516-1.el8_1 |
dotnet-host-fxr-2.1Red Hat:rhel_eus:8.1::appstream |
before 0:2.1.20-1.el8_1 | 0:2.1.20-1.el8_1 |
dotnet-host-fxr-2.1-debuginfoRed Hat:rhel_eus:8.1::appstream |
before 0:2.1.20-1.el8_1 | 0:2.1.20-1.el8_1 |
dotnet-runtime-2.1Red Hat:rhel_eus:8.1::appstream |
before 0:2.1.20-1.el8_1 | 0:2.1.20-1.el8_1 |
dotnet-runtime-2.1-debuginfoRed Hat:rhel_eus:8.1::appstream |
before 0:2.1.20-1.el8_1 | 0:2.1.20-1.el8_1 |
dotnet-sdk-2.1Red Hat:rhel_eus:8.1::appstream |
before 0:2.1.516-1.el8_1 | 0:2.1.516-1.el8_1 |
dotnet-sdk-2.1.5xxRed Hat:rhel_eus:8.1::appstream |
before 0:2.1.516-1.el8_1 | 0:2.1.516-1.el8_1 |
dotnet-sdk-2.1.5xx-debuginfoRed Hat:rhel_eus:8.1::appstream |
before 0:2.1.516-1.el8_1 | 0:2.1.516-1.el8_1 |
dotnetRed Hat:rhel_e4s:8.0::appstream |
before 0:2.1.516-1.el8_0 | 0:2.1.516-1.el8_0 |
dotnet-debuginfoRed Hat:rhel_e4s:8.0::appstream |
before 0:2.1.516-1.el8_0 | 0:2.1.516-1.el8_0 |
dotnet-debugsourceRed Hat:rhel_e4s:8.0::appstream |
before 0:2.1.516-1.el8_0 | 0:2.1.516-1.el8_0 |
dotnet-hostRed Hat:rhel_e4s:8.0::appstream |
before 0:2.1.20-1.el8_0 | 0:2.1.20-1.el8_0 |
dotnet-host-debuginfoRed Hat:rhel_e4s:8.0::appstream |
before 0:2.1.20-1.el8_0 | 0:2.1.20-1.el8_0 |
dotnet-host-fxr-2.1Red Hat:rhel_e4s:8.0::appstream |
before 0:2.1.20-1.el8_0 | 0:2.1.20-1.el8_0 |
dotnet-host-fxr-2.1-debuginfoRed Hat:rhel_e4s:8.0::appstream |
before 0:2.1.20-1.el8_0 | 0:2.1.20-1.el8_0 |
dotnet-runtime-2.1Red Hat:rhel_e4s:8.0::appstream |
before 0:2.1.20-1.el8_0 | 0:2.1.20-1.el8_0 |
dotnet-runtime-2.1-debuginfoRed Hat:rhel_e4s:8.0::appstream |
before 0:2.1.20-1.el8_0 | 0:2.1.20-1.el8_0 |
dotnet-sdk-2.1Red Hat:rhel_e4s:8.0::appstream |
before 0:2.1.516-1.el8_0 | 0:2.1.516-1.el8_0 |
dotnet-sdk-2.1.5xxRed Hat:rhel_e4s:8.0::appstream |
before 0:2.1.516-1.el8_0 | 0:2.1.516-1.el8_0 |
dotnet-sdk-2.1.5xx-debuginfoRed Hat:rhel_e4s:8.0::appstream |
before 0:2.1.516-1.el8_0 | 0:2.1.516-1.el8_0 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Metasploit | SharePoint DataSet / DataTable Deserialization | 2020-07-14 |
| Exploit-DB | Microsoft SharePoint Server 2019 - Remote Code Execution | 2020-08-17 |
| Exploit-DB | Microsoft SharePoint Server 2019 - Remote Code Execution (2) | 2021-07-23 |
History
| Recorded | Changed | Sources |
|---|---|---|
| exploitation, exploits | ||
| first indexed | CVE List, EUVD, Exploit-DB, GitHub Advisories, CISA KEV, Metasploit, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-1147 is a high vulnerability (CVSS 7.8) in Microsoft .net Framework, published July 14, 2020. CISA lists it as known to be exploited, since November 3, 2021. EUVD reports exploitation since November 3, 2021. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 95.8%, the 99th percentile. Fixed in Microsoft.NETCore.App 2.1.20.
References
portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1147
packetstormsecurity.com/files/158694/SharePoint-DataSet-DataTable-Deserialization.html
exploitalert.com/view-details.html?id=35992
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-1147
Show 20 moreShow less
nvd.nist.gov/vuln/detail/CVE-2020-1147
github.com/dotnet/announcements/issues/159
access.redhat.com/errata/RHSA-2020:2937
bugzilla.redhat.com/show_bug.cgi?id=1856929
security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2937.json
cve.org/CVERecord?id=CVE-2020-1147