CVE-2020-0971

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microsoft SharePoint Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0920, CVE-2020-0929, CVE-2020-0931, CVE-2020-0932, CVE-2020-0974.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

Vendor	Product	Versions
Microsoft	Microsoft SharePoint Enterprise Server	2016
Microsoft	Microsoft SharePoint Server	2019
Microsoft	Microsoft SharePoint Foundation	2010 Service Pack 2; 2013 Service Pack 1

References

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0971Patch, Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-20-1398/Third Party Advisory, VDB Entry
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0971Patch, Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-20-1398/Third Party Advisory, VDB Entry

Timeline

Published: Apr 15, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-09725.4A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected S CVE-2020-09735.4A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web reques CVE-2020-09748.8A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application pa CVE-2020-09755.4A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected S CVE-2020-09765.4A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected S CVE-2020-09775.4A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected S CVE-2020-09785.4A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web reques CVE-2020-09798.8A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'CVE-2020-09807.8A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory, aka 'Microsoft W CVE-2020-09818.8A security feature bypass vulnerability exists when Windows fails to properly handle token relationships.An attacker who successfully exploi CVE-2020-09825.5An information disclosure vulnerability exists when the Microsoft Windows Graphics Component improperly handles objects in memory, aka 'Micr CVE-2020-09837.8An elevation of privilege vulnerability exists when the Windows Delivery Optimization service improperly handles objects in memory, aka 'Win