CVE-2020-1102

HIGH

Microsoft Sharepoint Enterprise Server - Unrestricted File Upload

Title source: rule

Description

A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microsoft SharePoint Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-1023, CVE-2020-1024.

Exploits (1)

nomisec WRITEUP 27 stars

by DanielRuf · poc

https://github.com/DanielRuf/snyk-js-jquery-565129

View Code ZIP pw:eip

References (1)

Core 1

Core References

Patch, Vendor Advisory x_refsource_misc

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1102

Scores

CVSS v3 8.8

EPSS 0.4625

EPSS Percentile 97.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-434

Status published

Products (2)

microsoft/sharepoint_enterprise_server 2016

microsoft/sharepoint_server 2019

Published May 21, 2020

Tracked Since Feb 18, 2026