GitHub Advisoryadvisory · NuGet

GHSA-g5vf-38cp-4px9 .NET Framework, SharePoint Server, and Visual Studio Remote Code Execution Vulnerability

HIGH Published 2022-05-24 Modified 2025-10-22 Official page ↗
Aliases
CVE-2020-1147
Ecosystem
NuGet
Packages
Microsoft.NETCore.App, Microsoft.NETCore.App.Runtime.linux-arm, Microsoft.NETCore.App.Runtime.linux-arm64, Microsoft.NETCore.App.Runtime.linux-musl-arm64, Microsoft.NETCore.App.Runtime.linux-musl-x64, Microsoft.NETCore.App.Runtime.linux-x64, Microsoft.NETCore.App.Runtime.osx-x64, Microsoft.NETCore.App.Runtime.rhel.6-x64, Microsoft.NETCore.App.Runtime.win-arm, Microsoft.NETCore.App.Runtime.win-arm64, Microsoft.NETCore.App.Runtime.win-x64, Microsoft.NETCore.App.Runtime.win-x86
Severity
High
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:H
Reviewed
2022-10-21

Affected packages

• NuGet Microsoft.NETCore.App: >= 2.1.0, < 2.1.20 → fixed in 2.1.20 • NuGet Microsoft.NETCore.App.Runtime.linux-arm: >= 3.1.0, < 3.1.6 → fixed in 3.1.6 • NuGet Microsoft.NETCore.App.Runtime.linux-arm64: >= 3.1.0, < 3.1.6 → fixed in 3.1.6 • NuGet Microsoft.NETCore.App.Runtime.linux-musl-arm64: >= 3.1.0, < 3.1.6 → fixed in 3.1.6 • NuGet Microsoft.NETCore.App.Runtime.linux-musl-x64: >= 3.1.0, < 3.1.6 → fixed in 3.1.6 • NuGet Microsoft.NETCore.App.Runtime.linux-x64: >= 3.1.0, < 3.1.6 → fixed in 3.1.6 • NuGet Microsoft.NETCore.App.Runtime.osx-x64: >= 3.1.0, < 3.1.6 → fixed in 3.1.6 • NuGet Microsoft.NETCore.App.Runtime.rhel.6-x64: >= 3.1.0, < 3.1.6 → fixed in 3.1.6 • NuGet Microsoft.NETCore.App.Runtime.win-arm: >= 3.1.0, < 3.1.6 → fixed in 3.1.6 • NuGet Microsoft.NETCore.App.Runtime.win-arm64: >= 3.1.0, < 3.1.6 → fixed in 3.1.6 • NuGet Microsoft.NETCore.App.Runtime.win-x64: >= 3.1.0, < 3.1.6 → fixed in 3.1.6 • NuGet Microsoft.NETCore.App.Runtime.win-x86: >= 3.1.0, < 3.1.6 → fixed in 3.1.6

Description

A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and Visual Studio when the software fails to check the source markup of XML file input, aka '.NET Framework, SharePoint Server, and Visual Studio Remote Code Execution Vulnerability'.

Related

Alias · CVE (1)

  • CVE-2020-1147 A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and Visual Studio when the software fails to check… vulnerability

References