CVE-2020-0976

MEDIUM

Microsoft SharePoint Server - Spoofing via Improper Web Request Sanitization

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2020-0976. PoCs published by ericzhong2010.

AI-analyzed exploit summary This repository contains a GUI-based scanner for CVE-2020-0796 (incorrectly labeled as CVE-2020-0976 in the code). It checks for vulnerable SMBv3 compression handling by sending a crafted packet and analyzing the response.

Description

A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft SharePoint Spoofing Vulnerability'. This CVE ID is unique from CVE-2020-0972, CVE-2020-0975, CVE-2020-0977.

Exploits (1)

nomisec SCANNER

by ericzhong2010 · poc

https://github.com/ericzhong2010/GUI-Check-CVE-2020-0976

View Code ZIP pw:eip

This repository contains a GUI-based scanner for CVE-2020-0796 (incorrectly labeled as CVE-2020-0976 in the code). It checks for vulnerable SMBv3 compression handling by sending a crafted packet and analyzing the response.

Classification

Scanner 90%

Attack Type

Info Leak

Complexity

Moderate

Reliability

Reliable

Target: Microsoft Windows SMBv3 (versions 1903 and 1909)

No auth needed

Prerequisites: Network access to target systems on port 445

MITRE ATT&CK

T1069 - Permission Groups Discovery T1046 - Network Service Discovery

devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (1)

Core 1

Core References

Patch, Vendor Advisory x_refsource_misc

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0976

Scores

CVSS v3 5.4

EPSS 0.0059

EPSS Percentile 69.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Details

Status published

Products (2)

microsoft/sharepoint_enterprise_server 2016

microsoft/sharepoint_foundation 2013 sp1

Published Apr 15, 2020

Tracked Since Feb 18, 2026