CVE-2020-1147

A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and Visual Studio when the software fails to check the source markup of XML file input, aka '.NET Framework, SharePoint Server, and Visual Studio Remote Code Execution Vulnerability'.

Affected

Microsoft · Microsoft SharePoint Enterprise Server · Microsoft SharePoint Server · Microsoft Visual Studio 2019 · Microsoft Visual Studio 2019 version 16.6 (includes 16.0 - 16.5) · Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8) · Microsoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3)

CVSS v3.1 NVD

7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVSS v3.1 GitHub

7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:H

CVSS v2.0 NVD

6.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P

EPSS

93.97% chance of exploitation in the next 30 days, 100th percentile

CISA KEV

added 2021-11-03

Nuclei

critical

Published

2020-07-14

Updated

2025-10-21

Proof-of-concept exploits (3)

• http://packetstormsecurity.com/files/158694/SharePoint-DataSet-DataTable-Deserialization…
• http://packetstormsecurity.com/files/158876/Microsoft-SharePoint-Server-2019-Remote-Code-…
• http://packetstormsecurity.com/files/163644/Microsoft-SharePoint-Server-2019-Remote-Code-…

Nuclei templates (1)

• linuxadi/40k-nuclei-templates/blob/main/aditya/folder4/cve-2020-1147-4404.yaml

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/sharepoint_data_des…

ExploitDB entries (2)

• https://www.exploit-db.com/exploits/50151
• https://www.exploit-db.com/exploits/48747

Security advisories

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1147
• https://www.exploitalert.com/view-details.html?id=35992
• advisories/GHSA-g5vf-38cp-4px9

References

• CVE Record
• NVD entry