CVE-2020-1147
Vulnérabilité élevée dans Microsoft SharePoint Enterprise Server (Microsoft)
CVSS 7.8 · Élevée
EPSS 94.0%
Microsoft•Microsoft SharePoint Enterprise Server•Versions : Windows 7 for 32-bit Systems Service Pack 1, Windows Server 2008 for x64-based Systems Service Pack 2, Service Pack 2 on Windows Server 2008 for x64-based Systems Service Pack 2, 1903, Windows Server 2012 R2 (Server Core installation), 3.1, Windows 8.1 for 32-bit systems, Windows 8.1 for x64-based systems, 2010 Service Pack 2, 2016, 2019, Windows Server 2008 R2 for x64-based Systems Service Pack 1, Windows Server 2012 R2, Windows Server 2012 (Server Core installation), 2.1, Windows Server 2012, Windows RT 8.1, Windows Server 2008 for 32-bit Systems Service Pack 2, Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation), 2013 Service Pack 1, Windows 7 for x64-based Systems Service Pack 1, 16.0, Service Pack 2 on Windows Server 2008 for 32-bit Systems Service Pack 2
Description
A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and Visual Studio when the software fails to check the source markup of XML file input, aka '.NET Framework, SharePoint Server, and Visual Studio Remote Code Execution Vulnerability'.
Gravité et risque d'exploitation
CVE-2020-1147 obtient un score CVSS de 7.8/10, soit une gravité élevée. Selon le modèle EPSS, la probabilité qu'elle soit exploitée dans les 30 prochains jours est de 93.97 %, ce qui la place devant 99.8 % des CVE référencées.
Que faire ?
- Vérifiez si Microsoft SharePoint Enterprise Server (versions Windows 7 for 32-bit Systems Service Pack 1, Windows Server 2008 for x64-based Systems Service Pack 2, Service Pack 2 on Windows Server 2008 for x64-based Systems Service Pack 2, 1903, Windows Server 2012 R2 (Server Core installation), 3.1, Windows 8.1 for 32-bit systems, Windows 8.1 for x64-based systems, 2010 Service Pack 2, 2016, 2019, Windows Server 2008 R2 for x64-based Systems Service Pack 1, Windows Server 2012 R2, Windows Server 2012 (Server Core installation), 2.1, Windows Server 2012, Windows RT 8.1, Windows Server 2008 for 32-bit Systems Service Pack 2, Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation), 2013 Service Pack 1, Windows 7 for x64-based Systems Service Pack 1, 16.0, Service Pack 2 on Windows Server 2008 for 32-bit Systems Service Pack 2) est présent sur votre parc.
- Appliquez le correctif ou la version corrigée indiqués dans les références de l'éditeur.
- À défaut de correctif, limitez l'exposition (filtrage réseau, désactivation du composant).
- Automatisez la détection : les agents CVE Heimdall (gratuits, open source) corrèlent l'inventaire de vos serveurs avec la base CVE.
Références
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1147
- http://packetstormsecurity.com/files/158694/SharePoint-DataSet-DataTable-Deserialization.html
- http://packetstormsecurity.com/files/158876/Microsoft-SharePoint-Server-2019-Remote-Code-Execution.html
- https://www.exploitalert.com/view-details.html?id=35992
- http://packetstormsecurity.com/files/163644/Microsoft-SharePoint-Server-2019-Remote-Code-Execution.html