Cyber Resilience

CVE-2020-1181

Microsoft Sharepoint Foundation 2010 … 2013

High EPSS
Published
09 June 2020
Modified
21 November 2024
Patch / advisory
View advisory
CVSS Score v3.1 8.8
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.69 99.3th percentile
Risk Priority 87 floored blend · peak EPSS

Summary

CVE-2020-1181 is a high-severity an unspecified weakness vulnerability in Microsoft Sharepoint Foundation. Its CVSS base score is 8.8 (High).

Operationally, ranked in the top 0.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability Data

A remote code execution vulnerability exists in Microsoft SharePoint Server when it fails to properly identify and filter unsafe ASP.Net web controls, aka 'Microsoft SharePoint Server Remote Code Execution Vulnerability'.

CWE(s)
NVD-CWE-noinfo

Related Threats

Likely ATT&CK TechniquesAI

Techniques this vulnerability likely enables, inferred from its description, weakness type, and attributed-actor tradecraft. Confidence is per-technique.

T1190 Exploit Public-Facing Application Initial Accessconfidence: HIGH
The CVE describes a remote code execution flaw in a public-facing SharePoint Server application, directly enabling exploitation of a remote service.
attack.mitre.org →
T1059 Command and Scripting Interpreter Executionconfidence: MEDIUM
Unsafe ASP.Net web controls can be abused to execute arbitrary commands or scripts on the server.
attack.mitre.org →
T1505.003 Web Shell Persistenceconfidence: MEDIUM
Successful exploitation of the RCE could allow an attacker to deploy a web shell on the SharePoint server.
attack.mitre.org →
inferred from description · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2020-16952Same product: Microsoft Sharepoint Enterprise Server
CVE-2019-0604Same product: Microsoft Sharepoint Enterprise Server
CVE-2023-21717Same product: Microsoft Sharepoint Enterprise Server
CVE-2022-35823Same product: Microsoft Sharepoint Enterprise Server
CVE-2022-37961Same product: Microsoft Sharepoint Enterprise Server
CVE-2022-38053Same product: Microsoft Sharepoint Enterprise Server
CVE-2023-24955Same product: Microsoft Sharepoint Enterprise Server
CVE-2023-24950Same product: Microsoft Sharepoint Enterprise Server
CVE-2023-21742Same product: Microsoft Sharepoint Foundation
CVE-2022-44690Same product: Microsoft Sharepoint Foundation

Affected Assets

microsoft
sharepoint enterprise server
2016
microsoft
sharepoint foundation
2010, 2013
microsoft
sharepoint server
2019

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References