CVE-2020-1181: 
vulnerability analysis and mitigation

A remote code execution vulnerability (CVE-2020-1181) exists in Microsoft SharePoint Server when it fails to properly identify and filter unsafe ASP.Net web controls. The vulnerability was disclosed on June 9, 2020, affecting multiple versions of SharePoint including SharePoint Enterprise Server 2016, SharePoint Foundation 2010 SP2, SharePoint Foundation 2013 SP1, and SharePoint Server 2019 (NVD).

The specific flaw exists within the handling of Web Parts. When creating a SharePoint page, an attacker can upload XML containing an arbitrary Web Part definition. The vulnerability has a CVSS v3.1 Base Score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (ZDI Advisory, NVD).

An attacker can leverage this vulnerability to execute code in the context of the service account. The vulnerability affects confidentiality, integrity, and availability of the system with high severity ratings for each aspect (ZDI Advisory).

Authentication is required to exploit this vulnerability. The attack complexity is considered low, requiring privileged access but no user interaction for successful exploitation (NVD).

Microsoft has issued a security update to correct this vulnerability. The fix is available through Microsoft Update and can be downloaded from the Microsoft Update Catalog. The update must be applied to affected SharePoint installations to mitigate the vulnerability (ZDI Advisory).