Skip to content
CVE Tracker
Back

CVE-2020-1069

Microsoft SharePoint Server Remote Code Execution Vulnerability

High8.8EPSS 4.0%
Published
Updated
Reserved
Assigned by
microsoft

Description

A remote code execution vulnerability exists in Microsoft SharePoint Server when it fails to properly identify and filter unsafe ASP.Net web controls. An authenticated attacker who successfully exploited the vulnerability could use a specially crafted page to perform actions in the security context of the SharePoint application pool process. To exploit the vulnerability, an authenticated user must create and invoke a specially crafted page on an affected version of Microsoft SharePoint Server. The security update addresses the vulnerability by correcting how Microsoft SharePoint Server handles processing of created content.

Scores

CVSS scores of CVE-2020-1069, by who scored it
Scored byCVSSScoreVector
NVDNVD · Modified3.1High8.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS (exploitation in 30 days)
4.0% · top 9.4% of all CVEs (2 Nov 2026)

Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.8.

Weakness

Affected products

  • Microsoft · Microsoft SharePoint Enterprise Server 2016

    • affected 16.0.0 – < publication

  • Microsoft · Microsoft SharePoint Foundation 2013 Service Pack 1

    • affected 15.0.0 – < publication

  • Microsoft · Microsoft SharePoint Server 2019

    • affected 16.0.0 – < publication

References (3)

Sources

The same CVE in the primary databases and aggregators, to check against.

Record last updated .