CVE-2020-1439

A remote code execution vulnerability exists in PerformancePoint Services for SharePoint Server when the software fails to check the source markup of XML file input, aka 'PerformancePoint Services Remote Code Execution Vulnerability'.

Published: Jul 15, 2020
Updated: Apr 13, 2023
CVE: CVE-2020-1439
Severity: High
Exploit:

CVSS v3:

Severity: High
Score: 8.8
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2:

Severity: Medium
Score: 6.5
AV:N/AC:L/Au:S/C:P/I:P/A:P

CWEs:

CWE-502

OWASP TOP 10:

A8 - Insecure Deserialization

Affected Software
References

Software	From	Fixed in
microsoft / sharepoint_foundation	2013-sp1	2013-sp1.x
microsoft / sharepoint_server	2010-sp2	2010-sp2.x
microsoft / sharepoint_enterprise_server	2016	2016.x
microsoft / sharepoint_enterprise_server	2013-sp1	2013-sp1.x
microsoft / sharepoint_server	2019	2019.x

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1439
https://www.zerodayinitiative.com/advisories/ZDI-20-874/

Vulnerability Database

289,697

CVE-2020-1439