2021-01-02 04:56:15 +00:00
id : CVE-2020-16952
2020-10-14 08:49:48 +00:00
info :
2022-07-26 13:45:11 +00:00
name : Microsoft SharePoint - Remote Code Execution
2020-10-14 08:49:48 +00:00
author : dwisiswant0
2021-09-10 11:26:40 +00:00
severity : high
2022-07-26 13:45:11 +00:00
description : Microsoft SharePoint is vulnerable to a remote code execution when the software fails to check the source markup of an application package.
2023-09-06 12:22:36 +00:00
remediation : |
Apply the latest security updates provided by Microsoft to address this vulnerability.
2021-08-18 11:37:49 +00:00
reference :
2021-03-11 15:06:39 +00:00
- https://srcincite.io/pocs/cve-2020-16952.py.txt
2022-04-25 23:43:33 +00:00
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16952
2021-03-11 15:06:39 +00:00
- https://github.com/rapid7/metasploit-framework/blob/1a341ae93191ac5f6d8a9603aebb6b3a1f65f107/documentation/modules/exploit/windows/http/sharepoint_ssi_viewstate.md
2022-07-26 13:45:11 +00:00
- https://nvd.nist.gov/vuln/detail/CVE-2020-16952
2021-09-10 11:26:40 +00:00
classification :
cvss-metrics : CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
2022-04-22 10:38:41 +00:00
cvss-score : 7.8
2021-09-10 11:26:40 +00:00
cve-id : CVE-2020-16952
cwe-id : CWE-346
2023-10-22 12:16:24 +00:00
epss-score : 0.4236
2023-11-14 05:56:48 +00:00
epss-percentile : 0.96957
2023-09-06 12:22:36 +00:00
cpe : cpe:2.3:a:microsoft:sharepoint_enterprise_server:2016:*:*:*:*:*:*:*
2023-04-28 08:11:21 +00:00
metadata :
max-request : 1
2023-07-15 16:29:17 +00:00
vendor : microsoft
product : sharepoint_enterprise_server
tags : msf,cve,cve2020,sharepoint,iis,microsoft,ssi,rce
2020-10-14 08:49:48 +00:00
2023-04-27 04:28:59 +00:00
http :
2020-10-15 10:27:52 +00:00
- method : GET
2020-10-14 08:49:48 +00:00
path :
2021-01-13 07:31:46 +00:00
- "{{BaseURL}}"
2022-04-25 23:43:33 +00:00
2020-10-14 08:49:48 +00:00
matchers-condition : and
matchers :
2020-10-15 10:27:52 +00:00
- type : regex
2022-04-25 23:43:33 +00:00
part : body
2020-10-15 10:27:52 +00:00
regex :
2020-10-15 11:21:25 +00:00
- "15\\.0\\.0\\.(4571|5275|4351|5056)"
- "16\\.0\\.0\\.(10337|10364|10366)"
2020-10-15 10:27:52 +00:00
# - "16.0.10364.20001"
condition : or
2022-04-25 23:43:33 +00:00
- type : regex
2020-10-15 10:27:52 +00:00
part : header
2022-04-25 23:43:33 +00:00
regex :
- "(?i)(Microsoftsharepointteamservices:)"
2020-10-14 08:49:48 +00:00
- type : status
status :
2020-10-15 10:27:52 +00:00
- 200
- 201
2022-01-04 19:34:16 +00:00
condition : or
2023-11-14 14:37:18 +00:00
# digest: 490a0046304402205974c7a85dd6f0bdf3d281413af0ad70dc114d770ecb71e4171499ca0cf1dae5022050771dc1108988df440aad8515d9729f2dcb7c2f6c85fd460a88579c48f2ca45:922c64590222798bb761d5b6d8e72950
