{"id":"CVE-2020-1439","aliases":["EUVD-2020-12315","GHSA-7vrg-q6mv-3q9x"],"status":"published","title":"A remote code execution vulnerability exists in PerformancePoint Services for SharePoint Server...","description":"A remote code execution vulnerability exists in PerformancePoint Services for SharePoint Server when the software fails to check the source markup of XML file input, aka 'PerformancePoint Services Remote Code Execution Vulnerability'.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.20265,"percentile":0.97488,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-502"],"published":"2020-07-14T22:54:44Z","modified":"2026-06-17T03:01:25Z","products":[{"vendor":"microsoft","product":"microsoft sharepoint enterprise server"},{"vendor":"microsoft","product":"microsoft sharepoint foundation"},{"vendor":"microsoft","product":"microsoft sharepoint server"},{"vendor":"microsoft","product":"sharepoint_enterprise_server"},{"vendor":"microsoft","product":"sharepoint_foundation"},{"vendor":"microsoft","product":"sharepoint_server"}],"references":[{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1439","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory"]},{"url":"https://www.zerodayinitiative.com/advisories/ZDI-20-874/","tags":["x_refsource_MISC","x_transferred","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-1439"},{"url":"https://github.com/advisories/GHSA-7vrg-q6mv-3q9x"}],"sources":{"cve":[{"id":"CVE-2020-1439","description":"A remote code execution vulnerability exists in PerformancePoint Services for SharePoint Server when the software fails to check the source markup of XML file input, aka 'PerformancePoint Services Remote Code Execution Vulnerability'.","status":"published","published":"2020-07-14T22:54:44Z","modified":"2024-08-04T06:39:10.465Z","updated_at":"2026-11-02T14:35:56.638833Z"}],"euvd":[{"id":"EUVD-2020-12315","description":"A remote code execution vulnerability exists in PerformancePoint Services for SharePoint Server when the software fails to check the source markup of XML file input, aka 'PerformancePoint Services Remote Code Execution Vulnerability'.","status":"published","published":"2020-07-14T22:54:44Z","modified":"2024-08-04T06:39:10Z","updated_at":"2026-11-03T03:08:12.895997Z"}],"ghsa":[{"id":"GHSA-7vrg-q6mv-3q9x","title":"A remote code execution vulnerability exists in PerformancePoint Services for SharePoint Server...","description":"A remote code execution vulnerability exists in PerformancePoint Services for SharePoint Server when the software fails to check the source markup of XML file input, aka 'PerformancePoint Services Remote Code Execution Vulnerability'.","status":"published","published":"2022-05-24T17:23:09Z","modified":"2023-01-29T05:03:24Z","updated_at":"2026-11-02T14:45:19.009235Z"}],"nvd":[{"id":"CVE-2020-1439","description":"A remote code execution vulnerability exists in PerformancePoint Services for SharePoint Server when the software fails to check the source markup of XML file input, aka 'PerformancePoint Services Remote Code Execution Vulnerability'.","status":"published","published":"2020-07-14T23:15:19.387Z","modified":"2026-06-17T03:01:25.083Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:06:09.126752Z"}]}}