CVE-2020-1147: Microsoft .NET Framework, SharePoint, and Visual Studio Remote Code Execution Vulnerability

CVSS: 7.8v3.1HighKEVAnalyzed

AliasesRHSA-2020:2937RHSA-2020:2938RHSA-2020:2939+4 more

Published 14-07-2020Last modified 21-10-2025

Vulnerability summary

CVE-2020-1147 is a high (CVSS 7.8) vulnerability in Microsoft .NET Framework, SharePoint, Visual Studio. It is known to be exploited: CISA lists it, first on 03-11-2021. EPSS estimates a 93.97% chance of exploitation in the next 30 days, higher than 99.8% of scored vulnerabilities. 7 public exploits are recorded.

Overall risk

85/100

0100

Critical · default modelHow is this calculated?

CVSS score

7.8/10

010

High · v3.1 (CVE.org)

EPSS score

93.97%

0%100%

Critical · 0.00 pp in 30 days

KEVListedCISA

RansomwareNone recordedNo known use recorded

Public exploits7reference, exploit-database, metasploit

Timeline

14-07-2020
PublishedVulnerability first disclosed.
03-11-2021
Added to CISA KEVMicrosoft .NET Framework, SharePoint, and Visual Studio Remote Code Execution Vulnerability
03-05-2022
CISA remediation dueApply updates per vendor instructions.
21-10-2025
Last modifiedVulnerability information updated.

Description

A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and Visual Studio when the software fails to check the source markup of XML file input, aka '.NET Framework, SharePoint Server, and Visual Studio Remote Code Execution Vulnerability'.

CVSS metrics

5 scores · 4 sources · 2 versions

v3.17.8v2.06.8

EPSS trend

Probability

93.97%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

0.00 pp

From 93.97% on 19-09-2026

19-09-202619-10-2026

EPSS score

93.97%

Known exploited

Compare KEV catalogs

CISA KEVListed

Added: 03-11-2021
Federal due date: 03-05-2022

CISA required action

Apply updates per vendor instructions. nvd.nist.gov/vuln/detail/CVE-2020-1147

Public exploits

7 found

referenceUnverified
Exploit Reference (packetstormsecurity.com)
Maturity: unknown
referenceUnverified
Exploit Reference (packetstormsecurity.com)
Maturity: unknown
referenceUnverified
Exploit Reference (exploitalert.com)
Maturity: unknown

Show all 7 exploits

referenceUnverified
Exploit Reference (packetstormsecurity.com)
Maturity: unknown
exploit-databaseaspxUnverified
Microsoft SharePoint Server 2019 - Remote Code Execution
Maturity: poc
exploit-databaseaspxUnverified
Microsoft SharePoint Server 2019 - Remote Code Execution (2)
Maturity: poc
MetasploitremoteVerified
SharePoint DataSet / DataTable Deserialization
exploit/windows/http/sharepoint_data_deserialization
Maturity: weaponized

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Microsoft73 products

microsoft .net framework 2.0Service Pack 2 on Windows Server 2008 for 32-bit Systems Service Pack 2 | Service Pack 2 on Windows Server 2008 for x64-based Systems Service Pack 2
microsoft .net framework 3.0Service Pack 2 on Windows Server 2008 for 32-bit Systems Service Pack 2 | Service Pack 2 on Windows Server 2008 for x64-based Systems Service Pack 2
microsoft .net framework 3.5Windows 8.1 for 32-bit systems | Windows 8.1 for x64-based systems | Windows Server 2012 | Windows Server 2012 (Server Core installation) | Windows Server 2012 R2 | Windows Server 2012 R2 (Server Core installation)
microsoft .net framework 3.5 and 4.6.2/4.7/4.7.1/4.7.2 on windows 10 version 1607 for 32-bit systemsunspecified
microsoft .net framework 3.5 and 4.6.2/4.7/4.7.1/4.7.2 on windows 10 version 1607 for x64-based systemsunspecified

Show all 73

Redhat48 products

aspnetcore-runtime-3.1< 0:3.1.6-1.el8_2
aspnetcore-targeting-pack-3.1< 0:3.1.6-1.el8_2
dotnet< 0:2.1.516-1.el8_2 | < 0:3.1.106-1.el8_2 | < 0:2.1.516-1.el8_1 | < 0:2.1.516-1.el8_0
dotnet-apphost-pack-3.1< 0:3.1.6-1.el8_2
dotnet-apphost-pack-3.1-debuginfo< 0:3.1.6-1.el8_2

dotnet-debuginfo< 0:2.1.516-1.el8_2 | < 0:2.1.516-1.el8_1 | < 0:2.1.516-1.el8_0
dotnet-debugsource< 0:2.1.516-1.el8_2 | < 0:2.1.516-1.el8_1 | < 0:2.1.516-1.el8_0
dotnet-host< 0:3.1.6-1.el8_2 | < 0:2.1.20-1.el8_0
dotnet-host-debuginfo< 0:3.1.6-1.el8_2 | < 0:2.1.20-1.el8_0
dotnet-host-fxr-2.1< 0:2.1.20-1.el8_2 | < 0:2.1.20-1.el8_1 | < 0:2.1.20-1.el8_0
dotnet-host-fxr-2.1-debuginfo< 0:2.1.20-1.el8_2 | < 0:2.1.20-1.el8_1 | < 0:2.1.20-1.el8_0
dotnet-hostfxr-3.1< 0:3.1.6-1.el8_2
dotnet-hostfxr-3.1-debuginfo< 0:3.1.6-1.el8_2
dotnet-runtime-2.1< 0:2.1.20-1.el8_2 | < 0:2.1.20-1.el8_1 | < 0:2.1.20-1.el8_0
dotnet-runtime-2.1-debuginfo< 0:2.1.20-1.el8_2 | < 0:2.1.20-1.el8_1 | < 0:2.1.20-1.el8_0
dotnet-runtime-3.1< 0:3.1.6-1.el8_2
dotnet-runtime-3.1-debuginfo< 0:3.1.6-1.el8_2
dotnet-sdk-2.1< 0:2.1.516-1.el8_2 | < 0:2.1.516-1.el8_1 | < 0:2.1.516-1.el8_0
dotnet-sdk-2.1.5xx< 0:2.1.516-1.el8_2 | < 0:2.1.516-1.el8_1 | < 0:2.1.516-1.el8_0
dotnet-sdk-2.1.5xx-debuginfo< 0:2.1.516-1.el8_2 | < 0:2.1.516-1.el8_1 | < 0:2.1.516-1.el8_0
dotnet-sdk-3.1< 0:3.1.106-1.el8_2
dotnet-sdk-3.1-debuginfo< 0:3.1.106-1.el8_2
dotnet-targeting-pack-3.1< 0:3.1.6-1.el8_2
dotnet-templates-3.1< 0:3.1.106-1.el8_2
dotnet3.1< 0:3.1.106-1.el8_2
dotnet3.1-debuginfo< 0:3.1.106-1.el8_2
dotnet3.1-debugsource< 0:3.1.106-1.el8_2
netstandard-targeting-pack-2.1< 0:3.1.106-1.el8_2
rh-dotnet21< 0:2.1-19.el7
rh-dotnet21-dotnet< 0:2.1.516-1.el7
rh-dotnet21-dotnet-debuginfo< 0:2.1.516-1.el7
rh-dotnet21-dotnet-host< 0:2.1.20-1.el7
rh-dotnet21-dotnet-runtime-2.1< 0:2.1.20-1.el7
rh-dotnet21-dotnet-sdk-2.1< 0:2.1.516-1.el7
rh-dotnet21-dotnet-sdk-2.1.5xx< 0:2.1.516-1.el7
rh-dotnet21-runtime< 0:2.1-19.el7
rh-dotnet31-aspnetcore-runtime-3.1< 0:3.1.6-1.el7
rh-dotnet31-aspnetcore-targeting-pack-3.1< 0:3.1.6-1.el7
rh-dotnet31-dotnet< 0:3.1.106-1.el7
rh-dotnet31-dotnet-apphost-pack-3.1< 0:3.1.6-1.el7
rh-dotnet31-dotnet-debuginfo< 0:3.1.106-1.el7
rh-dotnet31-dotnet-host< 0:3.1.6-1.el7
rh-dotnet31-dotnet-hostfxr-3.1< 0:3.1.6-1.el7
rh-dotnet31-dotnet-runtime-3.1< 0:3.1.6-1.el7
rh-dotnet31-dotnet-sdk-3.1< 0:3.1.106-1.el7
rh-dotnet31-dotnet-targeting-pack-3.1< 0:3.1.6-1.el7
rh-dotnet31-dotnet-templates-3.1< 0:3.1.106-1.el7
rh-dotnet31-netstandard-targeting-pack-2.1< 0:3.1.106-1.el7

Show all 48

NuGet12 products

Microsoft.NETCore.App≥ 2.1.0, < 2.1.20
Microsoft.NETCore.App.Runtime.linux-arm≥ 3.1.0, < 3.1.6
Microsoft.NETCore.App.Runtime.linux-arm64≥ 3.1.0, < 3.1.6
Microsoft.NETCore.App.Runtime.linux-musl-arm64≥ 3.1.0, < 3.1.6
Microsoft.NETCore.App.Runtime.linux-musl-x64≥ 3.1.0, < 3.1.6

Show all 12

3 vendors · 133 products

References

25 links

portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1147X Refsource MISCWEBPatchVendor Advisory
packetstormsecurity.com/files/158694/SharePoint-DataSet-DataTable-Deserialization.htmlX Refsource MISCWEBExploitThird Party AdvisoryVDB Entry
packetstormsecurity.com/files/158876/Microsoft-SharePoint-Server-2019-Remote-Code-Execution.htmlX Refsource MISCWEBExploitThird Party AdvisoryVDB Entry
www.exploitalert.com/view-details.html?id=35992X Refsource MISCWEBExploitThird Party Advisory
packetstormsecurity.com/files/163644/Microsoft-SharePoint-Server-2019-Remote-Code-Execution.htmlX Refsource MISCWEBExploitThird Party AdvisoryVDB Entry
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-1147Government ResourceWEBUS Government Resource
access.redhat.com/errata/RHSA-2020:2937Advisory
access.redhat.com/security/updates/classification/ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=1856929REPORT
security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2937.jsonAdvisory

Show all 25 references

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities