{"id":"CVE-2020-1147","kind":"vulnerability","aliases":["CVE-2020-1147"],"related":[],"title":"Microsoft .NET Framework, SharePoint, Visual Studio: Microsoft .NET Framework, SharePoint, and Visual Studio Remote Code Execution Vulnerability","description":"Microsoft .NET Framework, Microsoft SharePoint, and Visual Studio contain a remote code execution vulnerability when the software fails to check the source markup of XML file input. Successful exploitation allows an attacker to execute code in the context of the process responsible for deserialization of the XML content.\n\nCISA required action: Apply updates per vendor instructions.","summary":"Microsoft .NET Framework, SharePoint, and Visual Studio fail to check the source markup of XML input during deserialization. An attacker who supplies crafted XML can run code in the context of the process that deserializes it.","severity":"critical","cvss":7.8,"epss":0.93966,"exploited":true,"exploited_at":"2021-11-03T00:00:00+00:00","products":[{"name":"Microsoft .NET Framework, SharePoint, Visual Studio","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["dotnet","exploited","runtime","sharepoint","visual-studio","windows"],"not_affected_if":["patched-systems"],"how_to_check":null,"fix":"Apply the Microsoft security updates for .NET Framework, SharePoint and Visual Studio per vendor instructions (CISA required action). Specific patched versions: unknown","status":"open","published_at":"2020-07-14T23:15:12+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T21:39:14+00:00","updated_at":"2026-10-23T21:57:34+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-23T21:39:14Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Microsoft security updates for .NET Framework, SharePoint and Visual Studio per vendor instructions (CISA required action). Specific patched versions: unknown","reach":"network","impact":"high","summary":"Microsoft .NET Framework, SharePoint, and Visual Studio fail to check the source markup of XML input during deserialization. An attacker who supplies crafted XML can run code in the context of the process that deserializes it.","category":"runtime","who_cares":["dotnet","sharepoint","visual-studio","windows"],"confidence":0.7,"needs_auth":"unknown","worst_case":"Attacker runs code in the deserializing process context.","analyst_note":"Get the affected and fixed .NET Framework, SharePoint and Visual Studio versions and the Microsoft advisory for CVE-2020-1147, plus the exact trigger conditions, from the MSRC entry for this CVE.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["patched-systems"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000488,"input_tokens":2924,"output_tokens":392,"severity_before":"unknown"},"analyst_status":"queued","analyst_note":"Get the affected and fixed .NET Framework, SharePoint and Visual Studio versions and the Microsoft advisory for CVE-2020-1147, plus the exact trigger conditions, from the MSRC entry for this CVE.","search":"'-1147':20A,23A '-2020':19A,22A 'action':123C 'allow':102C 'appli':124C 'attack':57B,104C 'check':47B,92C 'cisa':121C 'code':15A,64B,84C,107C 'contain':81C 'content':120C 'context':67B,110C 'craft':60B 'cve':18A,21A 'deseri':55B,72B,116C 'dotnet':30B 'execut':16A,85C,106C 'exploit':31B,101C 'fail':45B,90C 'file':98C 'framework':3A,9A,26A,40B,75C 'input':53B,99C 'instruct':128C 'markup':50B,95C 'microsoft':1A,7A,24A,38B,73C,76C 'net':2A,8A,25A,39B,74C 'per':126C 'process':70B,113C 'remot':14A,83C 'requir':122C 'respons':114C 'run':63B 'runtim':32B 'sharepoint':4A,10A,27A,33B,41B,77C 'softwar':89C 'sourc':49B,94C 'studio':6A,13A,29A,36B,44B,80C 'success':100C 'suppli':59B 'updat':125C 'vendor':127C 'visual':5A,12A,28A,35B,43B,79C 'visual-studio':34B 'vulner':17A,86C 'window':37B 'xml':52B,61B,97C,119C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2020-07-14T23:15:12+00:00","kev":{"dateAdded":"2021-11-03","dueDate":"2022-05-03","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2020-1147","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-1147","severity":null,"published_at":"2021-11-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T15:39:44+00:00","note":null},{"source":"epss","external_id":"CVE-2020-1147","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-1147","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2020-1147","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-1147","severity":null,"published_at":"2020-07-14T23:15:12+00:00","modified_at":"2026-06-17T03:00:34+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T21:57:34+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}