CVE-2020-1200: 
vulnerability analysis and mitigation

A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package (CVE-2020-1200). The vulnerability was disclosed and patched as part of Microsoft's September 8, 2020 security updates (Microsoft Update). The affected systems include SharePoint Foundation 2013 SP1, SharePoint Enterprise Server 2016, and SharePoint Server 2019 (NVD).

The vulnerability occurs when SharePoint fails to properly validate the source markup of application packages. The vulnerability has been assigned a CVSS v3.1 base score of 8.6 HIGH (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L) and is classified under CWE-494 (Download of Code Without Integrity Check) (NVD).

An attacker who successfully exploits this vulnerability could run arbitrary code in the context of the SharePoint application pool and the SharePoint server farm account (NVD).

Exploitation of this vulnerability requires that a user uploads a specially crafted SharePoint application package to an affected version of SharePoint (NVD).

Microsoft has released security updates to address this vulnerability. The security update addresses the vulnerability by correcting how SharePoint checks the source markup of application packages. Users should install the appropriate security update for their SharePoint version: KB4484525 for SharePoint Foundation 2013 or KB4484506 for SharePoint Server 2016 (Microsoft Update).