{"schemaVersion":3,"id":"CVE-2020-0931","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microsoft SharePoint Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0920, CVE-2020-0929, CVE-2020-0932, CVE-2020-0971, CVE-2020-0974.","dates":{"published":"2020-04-15T15:12:52.000Z","modified":"2024-08-04T06:18:03.608Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":8.8,"severity":"high","version":"3.1","versionLabel":"v3.1","source":"NVD","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":8.8,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":6.5,"severity":"medium","vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.10695,"percentile":0.95779,"severity":"medium","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.10695},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.10695,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.10695,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.10695,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.10695,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.10695,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.10695,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.10695,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.10695,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.10695,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.10695,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.10695,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.10695,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.10695,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.10695,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.10695,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.10695,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.10695,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.10695,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.10695,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.10695,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.10695,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.10695,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.10695,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.10695,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.10695,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.10695,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.10695,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.10695,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.10695,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.10695,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.10695,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.10695,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.10695,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.10695,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.10695,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.10695,"percentile":0.95779}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.10695,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.10695,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.10695,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.10695,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.10695,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.10695,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.10695,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.10695,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.10695,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.10695,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.10695,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.10695,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.10695,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.10695,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.10695,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.10695,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.10695,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.10695,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.10695,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.10695,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.10695,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.10695,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.10695,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.10695,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.10695,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.10695,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.10695,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.10695,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.10695,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.10695,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.10695,"percentile":0.95779}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-434","name":"Unrestricted Upload of File with Dangerous Type","description":"The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":"Medium","url":"https://cwe.mitre.org/data/definitions/434.html"}],"affected":[{"vendor":"microsoft","product":"business_productivity_servers","name":"business productivity servers","label":"business_productivity_servers","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"2010:sp2","noFixRecorded":false,"fixedIn":null}],"versionsText":"2010:sp2","eol":null,"hubHref":"/vendor/microsoft/business_productivity_servers"},{"vendor":"microsoft","product":"microsoft business productivity servers","name":"Microsoft Business Productivity Servers","label":"microsoft business productivity servers","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"2010 Service Pack 2","noFixRecorded":false,"fixedIn":null}],"versionsText":"2010 Service Pack 2","eol":null,"hubHref":"/vendor/microsoft/microsoft_business_productivity_servers"},{"vendor":"microsoft","product":"microsoft sharepoint enterprise server","name":"Microsoft SharePoint Enterprise Server","label":"microsoft sharepoint enterprise server","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"2013 Service Pack 1","noFixRecorded":false,"fixedIn":null},{"text":"2016","noFixRecorded":false,"fixedIn":null}],"versionsText":"2013 Service Pack 1 | 2016","eol":null,"hubHref":"/vendor/microsoft/microsoft_sharepoint_enterprise_server"},{"vendor":"microsoft","product":"microsoft sharepoint foundation","name":"Microsoft SharePoint Foundation","label":"microsoft sharepoint foundation","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"2013 Service Pack 1","noFixRecorded":false,"fixedIn":null}],"versionsText":"2013 Service Pack 1","eol":null,"hubHref":"/vendor/microsoft/microsoft_sharepoint_foundation"},{"vendor":"microsoft","product":"microsoft sharepoint server","name":"Microsoft SharePoint Server","label":"microsoft sharepoint server","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"2019","noFixRecorded":false,"fixedIn":null}],"versionsText":"2019","eol":null,"hubHref":"/vendor/microsoft/microsoft_sharepoint_server"},{"vendor":"microsoft","product":"sharepoint_enterprise_server","name":"sharepoint enterprise server","label":"sharepoint_enterprise_server","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"2013:sp1","noFixRecorded":false,"fixedIn":null},{"text":"2016","noFixRecorded":false,"fixedIn":null}],"versionsText":"2013:sp1 | 2016","eol":null,"hubHref":"/vendor/microsoft/sharepoint_enterprise_server"},{"vendor":"microsoft","product":"sharepoint_foundation","name":"sharepoint foundation","label":"sharepoint_foundation","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"2013:sp1","noFixRecorded":false,"fixedIn":null}],"versionsText":"2013:sp1","eol":null,"hubHref":"/vendor/microsoft/sharepoint_foundation"},{"vendor":"microsoft","product":"sharepoint_server","name":"sharepoint server","label":"sharepoint_server","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"2019","noFixRecorded":false,"fixedIn":null}],"versionsText":"2019","eol":null,"hubHref":"/vendor/microsoft/sharepoint_server"}],"affectedCount":8,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0931","label":"portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0931","hostname":"portal.msrc.microsoft.com","tags":["X Refsource MISC","Patch","Vendor Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2020-04-15T15:12:52.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-04T06:18:03.608Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":37,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T08:12:22.544Z","stale":false,"partial":false}}