CVE-2020-1147 — Vulnerability in...
.NET Framework, SharePoint Server, and Visual Studio Remote Code Execution Vulnerability
What Should I Do?
Patch Immediately
This vulnerability is confirmed under active exploitation (CISA KEV). Patch within 24-48 hours if possible.
Summary
Advisory Timeline
- First published May 24, 2022 (1602 days ago).
- Last revised October 22, 2025 — 1247 days after initial publication.
- Added to CISA's Known Exploited Vulnerabilities catalog 203 days before publication.
Remediation
Upgrade to the fixed version using your package manager.
dotnet add package Microsoft.NETCore.App.Runtime.linux-arm --version 3.1.6
dotnet add package Microsoft.NETCore.App.Runtime.linux-x64 --version 3.1.6
dotnet add package Microsoft.NETCore.App.Runtime.linux-arm64 --version 3.1.6
dotnet add package Microsoft.NETCore.App.Runtime.win-x86 --version 3.1.6
dotnet add package Microsoft.NETCore.App --version 2.1.20
dotnet add package Microsoft.NETCore.App.Runtime.linux-musl-x64 --version 3.1.6
dotnet add package Microsoft.NETCore.App.Runtime.osx-x64 --version 3.1.6
dotnet add package Microsoft.NETCore.App.Runtime.rhel.6-x64 --version 3.1.6
dotnet add package Microsoft.NETCore.App.Runtime.linux-musl-arm64 --version 3.1.6
dotnet add package Microsoft.NETCore.App.Runtime.win-x64 --version 3.1.6
dotnet add package Microsoft.NETCore.App.Runtime.win-arm64 --version 3.1.6
dotnet add package Microsoft.NETCore.App.Runtime.win-arm --version 3.1.6
After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.
Affected Packages (12)
Affects 1 ecosystem: nuget (12).
| Package | Ecosystem | Affected | Fixed In |
|---|---|---|---|
| Microsoft.NETCore.App.Runtime.linux-arm | nuget | 3.1.0, 3.1.1, 3.1.2, 3.1.3 (+2 more) | 3.1.6 |
| Microsoft.NETCore.App.Runtime.linux-x64 | nuget | 3.1.0, 3.1.1, 3.1.2, 3.1.3 (+2 more) | 3.1.6 |
| Microsoft.NETCore.App.Runtime.linux-arm64 | nuget | 3.1.0, 3.1.1, 3.1.2, 3.1.3 (+2 more) | 3.1.6 |
| Microsoft.NETCore.App.Runtime.win-x86 | nuget | 3.1.0, 3.1.1, 3.1.2, 3.1.3 (+2 more) | 3.1.6 |
| Microsoft.NETCore.App | nuget | 2.1.0, 2.1.1, 2.1.10, 2.1.11 (+16 more) | 2.1.20 |
| Microsoft.NETCore.App.Runtime.linux-musl-x64 | nuget | 3.1.0, 3.1.1, 3.1.2, 3.1.3 (+2 more) | 3.1.6 |
| Microsoft.NETCore.App.Runtime.osx-x64 | nuget | 3.1.0, 3.1.1, 3.1.2, 3.1.3 (+2 more) | 3.1.6 |
| Microsoft.NETCore.App.Runtime.rhel.6-x64 | nuget | 3.1.0, 3.1.1, 3.1.2, 3.1.3 (+2 more) | 3.1.6 |
| Microsoft.NETCore.App.Runtime.linux-musl-arm64 | nuget | 3.1.0, 3.1.1, 3.1.2, 3.1.3 (+2 more) | 3.1.6 |
| Microsoft.NETCore.App.Runtime.win-x64 | nuget | 3.1.0, 3.1.1, 3.1.2, 3.1.3 (+2 more) | 3.1.6 |
| Microsoft.NETCore.App.Runtime.win-arm64 | nuget | 3.1.0, 3.1.1, 3.1.2, 3.1.3 (+2 more) | 3.1.6 |
| Microsoft.NETCore.App.Runtime.win-arm | nuget | 3.1.0, 3.1.1, 3.1.2, 3.1.3 (+2 more) | 3.1.6 |
CVSS Score Breakdown
What the CVSS (Common Vulnerability Scoring System) 7.8 score means for each attack dimension.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:H
References
- https://nvd.nist.gov/vuln/detail/CVE-2020-1147ADVISORY
- https://github.com/dotnet/announcements/issues/159WEB
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1147WEB
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-1147WEB
- https://www.exploitalert.com/view-details.html?id=35992WEB
- https://packetstormsecurity.com/files/158694/SharePoint-DataSet-DataTable-Deserialization.htmlWEB
- https://packetstormsecurity.com/files/158876/Microsoft-SharePoint-Server-2019-Remote-Code-Execution.htmlWEB
- https://packetstormsecurity.com/files/163644/Microsoft-SharePoint-Server-2019-Remote-Code-Execution.htmlWEB
Frequently Asked Questions
- What is CVE-2020-1147?
- .NET Framework, SharePoint Server, and Visual Studio Remote Code Execution Vulnerability This vulnerability has been assigned a severity rating of HIGH (CVSS score: 7.8/10).
- How do I check if my project is affected by CVE-2020-1147?
- CVE-2020-1147 affects Microsoft.NETCore.App.Runtime.linux-arm, Microsoft.NETCore.App.Runtime.linux-x64 and Microsoft.NETCore.App.Runtime.linux-arm64 (and 9 more). This vulnerability is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, meaning it is being actively exploited in the wild. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2020-1147 and 200,000+ other known vulnerabilities.
Severity & Exploitability
High exploitability or significant impact. Prioritize remediation within days.
This vulnerability is in CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild.
Added to KEV catalog: November 3, 2021
Remediation deadline: May 3, 2022
Also Known As
Related CVEs
- CVE-2020-1108HIGH
.NET Core & .NET Framework Denial of Service Vulnerability
- CVE-2024-38095HIGH
Microsoft Security Advisory CVE-2024-38095 | .NET Denial of Service Vulnerability
- CVE-2023-29331HIGH
.NET Denial of Service vulnerability
- CVE-2026-50528HIGH
Microsoft Security Advisory CVE-2026-50528 – .NET Security Feature Bypass Vulnerability
- CVE-2021-26423HIGH
.NET Core Elevation of Privilege Vulnerability
- CVE-2021-1721MEDIUM
Denial of service in .NET core
- CVE-2024-38167MEDIUM
Microsoft Security Advisory CVE-2024-38167 | .NET Information Disclosure Vulnerability
- CVE-2021-34485MEDIUM
.NET Core Information Disclosure Vulnerability
Check if you're affected
Scan your dependencies to see if this vulnerability affects your projects.
Scan Your Dependencies