CVE-2020-1452: 
vulnerability analysis and mitigation

CVE-2020-1452 is a remote code execution vulnerability in Microsoft SharePoint that was disclosed on September 8, 2020. The vulnerability exists when the software fails to check the source markup of an application package. This vulnerability affects multiple versions of SharePoint, including SharePoint Enterprise Server 2013 SP1, SharePoint Enterprise Server 2016, SharePoint Foundation 2010 SP2, SharePoint Foundation 2013 SP1, and SharePoint Server 2019 (NVD).

The vulnerability has a CVSS v3.1 Base Score of 8.6 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L. The vulnerability is classified under CWE-494 (Download of Code Without Integrity Check). The technical issue stems from SharePoint's failure to properly validate the source markup of application packages, which could allow arbitrary code execution (NVD).

An attacker who successfully exploits this vulnerability could run arbitrary code in the context of the SharePoint application pool and the SharePoint server farm account. This could lead to unauthorized access, data compromise, and system manipulation (NVD).

Exploitation of this vulnerability requires that a user uploads a specially crafted SharePoint application package to an affected version of SharePoint. The vulnerability is network accessible with low attack complexity and requires no privileges or user interaction (NVD).

Microsoft has released security updates to address this vulnerability. The security update addresses the vulnerability by correcting how SharePoint checks the source markup of application packages. Updates are available through Microsoft Update or the Microsoft Update Catalog. Specific update packages include KB4484515 for SharePoint Enterprise Server 2013 and KB4484506 for SharePoint Server 2016 (Microsoft Support).