CVE-2020-1147highbajo ataque

CVE-2020-1147: fallo de gravedad alta en Microsoft .NET Framework 2.0

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Microsoft SharePoint Server+ Monitorear Microsoft SharePoint Enterprise Server

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

100Vexday Risk Score

Corrige ahora. Ella está bajo explotación confirmada por CISA y tiene exploit funcional público.

ssvc Actcvss 7.8epss 96%
de la publicación al arma34 días
Publicada en NVD14 jul
1ª PoC+34d
metasploit14 jul
CISA KEV+477d
Lo que declaran los fabricantes (VEX)

Declaraciones oficiales de los fabricantes en formato CSAF/VEX: si su producto está afectado, ya corregido o descartado — y por qué. Es afirmación del fabricante, no juicio de Vexday.

Red Hatdocumento VEX ↗
Corregido
6 productos (121 componentes)
Red Hat Enterprise Linux AppStream (v. 8) · .NET Core on Red Hat Enterprise Linux ComputeNode (v. 7) · .NET Core on Red Hat Enterprise Linux Server (v. 7) · .NET Core on Red Hat Enterprise Linux Workstation (v. 7) · Red Hat Enterprise Linux AppStream E4S (v. 8.0) · y otros 1
corrección ↗
Acción exigida por CISAplazo federal: 2022-05-03

Apply updates per vendor instructions.

En resumen

Una vulnerabilidad en .NET Framework, SharePoint y Visual Studio permite que atacantes ejecuten código malicioso de forma remota enviando archivos XML especialmente diseñados. El software no valida correctamente el origen del XML, permitiendo la ejecución de código en sistemas afectados.

Detalle técnico

Vulnerabilidad de ejecución remota de código desencadenada por validación insuficiente de entrada XML en .NET Framework, SharePoint y Visual Studio. Los atacantes pueden explotarla enviando marcado XML malicioso que elude las verificaciones de origen, resultando en ejecución de código arbitrario con los privilegios de la aplicación afectada.

Resumen generado y traducido por IA a partir de la descripción oficial.

El análisis completo de esta CVE está disponible en portugués →

A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and Visual Studio when the software fails to check the source markup of XML file input, aka '.NET Framework, SharePoint Server, and Visual Studio Remote Code Execution Vulnerability'.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Productos afectados
Microsoft · Microsoft .NET Framework 2.0Microsoft · Microsoft .NET Framework 3.0Microsoft · Microsoft .NET Framework 3.5Microsoft · Microsoft .NET Framework 3.5.1Microsoft · Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows 10 Version 1607 for 32-bit SystemsMicrosoft · Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows 10 Version 1607 for x64-based SystemsMicrosoft · Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2016Microsoft · Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2016 (Server Core installation)Microsoft · Microsoft .NET Framework 3.5 AND 4.6/4.6.1/4.6.2 on Windows 10 for 32-bit SystemsMicrosoft · Microsoft .NET Framework 3.5 AND 4.6/4.6.1/4.6.2 on Windows 10 for x64-based SystemsMicrosoft · Microsoft .NET Framework 3.5 AND 4.7.1/4.7.2 on Windows 10 Version 1709 for 32-bit SystemsMicrosoft · Microsoft .NET Framework 3.5 AND 4.7.1/4.7.2 on Windows 10 Version 1709 for ARM64-based SystemsMicrosoft · Microsoft .NET Framework 3.5 AND 4.7.1/4.7.2 on Windows 10 Version 1709 for x64-based SystemsMicrosoft · Microsoft .NET Framework 3.5 AND 4.7.2 on Windows 10 Version 1803 for 32-bit SystemsMicrosoft · Microsoft .NET Framework 3.5 AND 4.7.2 on Windows 10 Version 1803 for ARM64-based SystemsMicrosoft · Microsoft .NET Framework 3.5 AND 4.7.2 on Windows 10 Version 1803 for x64-based SystemsMicrosoft · Microsoft .NET Framework 3.5 AND 4.7.2 on Windows 10 Version 1809 for 32-bit SystemsMicrosoft · Microsoft .NET Framework 3.5 AND 4.7.2 on Windows 10 Version 1809 for ARM64-based SystemsMicrosoft · Microsoft .NET Framework 3.5 AND 4.7.2 on Windows 10 Version 1809 for x64-based SystemsMicrosoft · Microsoft .NET Framework 3.5 AND 4.7.2 on Windows Server 2019Microsoft · Microsoft .NET Framework 3.5 AND 4.7.2 on Windows Server 2019 (Server Core installation)Microsoft · Microsoft .NET Framework 3.5 AND 4.7.2 on Windows Server, version 1803 (Server Core Installation)Microsoft · Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 Version 1809 for 32-bit SystemsMicrosoft · Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 Version 1809 for x64-based SystemsMicrosoft · Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 Version 1903 for 32-bit SystemsMicrosoft · Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 Version 1903 for ARM64-based SystemsMicrosoft · Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 Version 1903 for x64-based SystemsMicrosoft · Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 Version 1909 for 32-bit SystemsMicrosoft · Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 Version 1909 for ARM64-based SystemsMicrosoft · Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 Version 1909 for x64-based SystemsMicrosoft · Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 Version 2004 for 32-bit SystemsMicrosoft · Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 Version 2004 for ARM64-based SystemsMicrosoft · Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 Version 2004 for x64-based SystemsMicrosoft · Microsoft .NET Framework 3.5 AND 4.8 on Windows Server 2019Microsoft · Microsoft .NET Framework 3.5 AND 4.8 on Windows Server 2019 (Server Core installation)Microsoft · Microsoft .NET Framework 3.5 AND 4.8 on Windows Server, version 1903 (Server Core installation)Microsoft · Microsoft .NET Framework 3.5 AND 4.8 on Windows Server, version 1909 (Server Core installation)Microsoft · Microsoft .NET Framework 3.5 AND 4.8 on Windows Server, version 2004 (Server Core installation)Microsoft · Microsoft .NET Framework 4.5.2Microsoft · Microsoft .NET Framework 4.6Microsoft · Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2Microsoft · Microsoft .NET Framework 4.8 on Windows 10 Version 1607 for 32-bit SystemsMicrosoft · Microsoft .NET Framework 4.8 on Windows 10 Version 1607 for x64-based SystemsMicrosoft · Microsoft .NET Framework 4.8 on Windows 10 Version 1709 for 32-bit SystemsMicrosoft · Microsoft .NET Framework 4.8 on Windows 10 Version 1709 for x64-based SystemsMicrosoft · Microsoft .NET Framework 4.8 on Windows 10 Version 1803 for 32-bit SystemsMicrosoft · Microsoft .NET Framework 4.8 on Windows 10 Version 1803 for x64-based SystemsMicrosoft · Microsoft .NET Framework 4.8 on Windows 7 for 32-bit Systems Service Pack 1Microsoft · Microsoft .NET Framework 4.8 on Windows 7 for x64-based Systems Service Pack 1Microsoft · Microsoft .NET Framework 4.8 on Windows 8.1 for 32-bit systemsMicrosoft · Microsoft .NET Framework 4.8 on Windows 8.1 for x64-based systemsMicrosoft · Microsoft .NET Framework 4.8 on Windows RT 8.1Microsoft · Microsoft .NET Framework 4.8 on Windows Server 2008 R2 for x64-based Systems Service Pack 1Microsoft · Microsoft .NET Framework 4.8 on Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)Microsoft · Microsoft .NET Framework 4.8 on Windows Server 2012Microsoft · Microsoft .NET Framework 4.8 on Windows Server 2012 R2Microsoft · Microsoft .NET Framework 4.8 on Windows Server 2012 R2 (Server Core installation)Microsoft · Microsoft .NET Framework 4.8 on Windows Server 2012 (Server Core installation)Microsoft · Microsoft .NET Framework 4.8 on Windows Server 2016Microsoft · Microsoft .NET Framework 4.8 on Windows Server 2016 (Server Core installation)Microsoft · Microsoft .NET Framework 4.8 on Windows Server, version 1803 (Server Core Installation)Microsoft · Microsoft SharePoint Enterprise ServerMicrosoft · Microsoft SharePoint ServerMicrosoft · Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)Microsoft · Microsoft Visual Studio 2019Microsoft · Microsoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3)Microsoft · Microsoft Visual Studio 2019 version 16.6 (includes 16.0 - 16.5)Microsoft · .NET Core
⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — Microsoft .NET Framework 2.0

En el mismo producto, de las más peligrosas a las menos.

CVE-2020-0646CRITICALCVE-2020-0646EPSS 99.2%KEVCVE-2024-29059HIGH.NET Framework Information Disclosure VulnerabilityEPSS 98.6%KEVCVE-2020-0605—CVE-2020-0605EPSS 18.4%CVE-2020-0606—CVE-2020-0606EPSS 18.3%CVE-2019-0613—CVE-2019-0613EPSS 15.4%CVE-2019-1113—CVE-2019-1113EPSS 10.0%