CVE-2020-1460: Microsoft SharePoint Server Remote Code Execution Vulnerability
<p>A remote code execution vulnerability exists in Microsoft SharePoint Server when it fails to properly identify and filter unsafe ASP.Net web controls. An authenticated attacker who successfully exploited the vulnerability could use a specially crafted page to perform actions in the security context of the SharePoint application pool process.</p> <p>To exploit the vulnerability, an authenticated user must create and invoke a specially crafted page on an affected version of Microsoft SharePoint Server.</p> <p>The security update addresses the vulnerability by correcting how Microsoft SharePoint Server handles processing of created content.</p>
Other sources
A remote code execution vulnerability exists in Microsoft SharePoint Server when it fails to properly identify and filter unsafe ASP.Net web controls, aka 'Microsoft SharePoint Server Remote Code Execution Vulnerability'.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2020-1460?
CVE-2020-1460 has a critical severity rating, indicating a high potential risk of remote code execution.
How do I fix CVE-2020-1460?
To fix CVE-2020-1460, it is recommended to apply the latest security updates provided by Microsoft for affected SharePoint versions.
Which versions are affected by CVE-2020-1460?
CVE-2020-1460 affects Microsoft SharePoint Enterprise Server 2013 SP1, 2016, Foundation 2010 SP2, Foundation 2013 SP1, and SharePoint Server 2019.
What kind of attack can exploit CVE-2020-1460?
CVE-2020-1460 can be exploited to perform remote code execution attacks, allowing an attacker to gain control over the affected system.
Is there a workaround for CVE-2020-1460?
While the best mitigation for CVE-2020-1460 is to apply the security update, administrators should implement strict access controls and monitor for unusual activities as interim measures.