CVE-2020-1147
.NET Framework, SharePoint Server, and Visual Studio Remote Code Execution Vulnerability
What Should I Do?
Patch Immediately
This vulnerability is confirmed under active exploitation (CISA KEV). Patch within 24-48 hours if possible.
Summary
Remediation
Upgrade to the fixed version using your package manager.
dotnet add package Microsoft.NETCore.App.Runtime.linux-arm --version 3.1.6
dotnet add package Microsoft.NETCore.App.Runtime.linux-x64 --version 3.1.6
dotnet add package Microsoft.NETCore.App.Runtime.linux-arm64 --version 3.1.6
dotnet add package Microsoft.NETCore.App.Runtime.win-x86 --version 3.1.6
dotnet add package Microsoft.NETCore.App --version 2.1.20
dotnet add package Microsoft.NETCore.App.Runtime.linux-musl-x64 --version 3.1.6
dotnet add package Microsoft.NETCore.App.Runtime.osx-x64 --version 3.1.6
dotnet add package Microsoft.NETCore.App.Runtime.rhel.6-x64 --version 3.1.6
dotnet add package Microsoft.NETCore.App.Runtime.linux-musl-arm64 --version 3.1.6
dotnet add package Microsoft.NETCore.App.Runtime.win-x64 --version 3.1.6
dotnet add package Microsoft.NETCore.App.Runtime.win-arm64 --version 3.1.6
dotnet add package Microsoft.NETCore.App.Runtime.win-arm --version 3.1.6
After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.
Affected Packages (12)
| Package | Ecosystem | Affected | Fixed In |
|---|---|---|---|
| Microsoft.NETCore.App.Runtime.linux-arm | nuget | 3.1.0, 3.1.1, 3.1.2, 3.1.3 (+2 more) | 3.1.6 |
| Microsoft.NETCore.App.Runtime.linux-x64 | nuget | 3.1.0, 3.1.1, 3.1.2, 3.1.3 (+2 more) | 3.1.6 |
| Microsoft.NETCore.App.Runtime.linux-arm64 | nuget | 3.1.0, 3.1.1, 3.1.2, 3.1.3 (+2 more) | 3.1.6 |
| Microsoft.NETCore.App.Runtime.win-x86 | nuget | 3.1.0, 3.1.1, 3.1.2, 3.1.3 (+2 more) | 3.1.6 |
| Microsoft.NETCore.App | nuget | 2.1.0, 2.1.1, 2.1.10, 2.1.11 (+16 more) | 2.1.20 |
| Microsoft.NETCore.App.Runtime.linux-musl-x64 | nuget | 3.1.0, 3.1.1, 3.1.2, 3.1.3 (+2 more) | 3.1.6 |
| Microsoft.NETCore.App.Runtime.osx-x64 | nuget | 3.1.0, 3.1.1, 3.1.2, 3.1.3 (+2 more) | 3.1.6 |
| Microsoft.NETCore.App.Runtime.rhel.6-x64 | nuget | 3.1.0, 3.1.1, 3.1.2, 3.1.3 (+2 more) | 3.1.6 |
| Microsoft.NETCore.App.Runtime.linux-musl-arm64 | nuget | 3.1.0, 3.1.1, 3.1.2, 3.1.3 (+2 more) | 3.1.6 |
| Microsoft.NETCore.App.Runtime.win-x64 | nuget | 3.1.0, 3.1.1, 3.1.2, 3.1.3 (+2 more) | 3.1.6 |
| Microsoft.NETCore.App.Runtime.win-arm64 | nuget | 3.1.0, 3.1.1, 3.1.2, 3.1.3 (+2 more) | 3.1.6 |
| Microsoft.NETCore.App.Runtime.win-arm | nuget | 3.1.0, 3.1.1, 3.1.2, 3.1.3 (+2 more) | 3.1.6 |
CVSS Score Breakdown
What the CVSS (Common Vulnerability Scoring System) 7.8 score means for each attack dimension.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:H
References
- https://nvd.nist.gov/vuln/detail/CVE-2020-1147ADVISORY
- https://github.com/dotnet/announcements/issues/159WEB
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1147WEB
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-1147WEB
- https://www.exploitalert.com/view-details.html?id=35992WEB
- https://packetstormsecurity.com/files/158694/SharePoint-DataSet-DataTable-Deserialization.htmlWEB
- https://packetstormsecurity.com/files/158876/Microsoft-SharePoint-Server-2019-Remote-Code-Execution.htmlWEB
- https://packetstormsecurity.com/files/163644/Microsoft-SharePoint-Server-2019-Remote-Code-Execution.htmlWEB
Frequently Asked Questions
- What is CVE-2020-1147?
- .NET Framework, SharePoint Server, and Visual Studio Remote Code Execution Vulnerability This vulnerability has been assigned a severity rating of HIGH (CVSS score: 7.8/10).
- How do I check if my project is affected by CVE-2020-1147?
- CVE-2020-1147 affects Microsoft.NETCore.App.Runtime.linux-arm, Microsoft.NETCore.App.Runtime.linux-x64 and Microsoft.NETCore.App.Runtime.linux-arm64 (and 9 more). This vulnerability is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, meaning it is being actively exploited in the wild. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2020-1147 and 200,000+ other known vulnerabilities.
Severity & Exploitability
High exploitability or significant impact. Prioritize remediation within days.
This vulnerability is in CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild.
Remediation deadline: May 3, 2022
Also Known As
Related CVEs
- CVE-2020-1108HIGH
.NET Core & .NET Framework Denial of Service Vulnerability
- CVE-2024-38095HIGH
Microsoft Security Advisory CVE-2024-38095 | .NET Denial of Service Vulnerability
- CVE-2024-21392HIGH
Microsoft Security Advisory CVE-2024-21392: .NET Denial of Service Vulnerability
- CVE-2021-26423HIGH
.NET Core Elevation of Privilege Vulnerability
- CVE-2026-50524HIGH
Microsoft Security Advisory CVE-2026-50524 – .NET Denial of Service Vulnerability
- CVE-2026-50651HIGH
Microsoft Security Advisory CVE-2026-50651 – .NET Denial of Service Vulnerability
- CVE-2024-38167MEDIUM
Microsoft Security Advisory CVE-2024-38167 | .NET Information Disclosure Vulnerability
- CVE-2021-34485MEDIUM
.NET Core Information Disclosure Vulnerability
Check if you're affected
Scan your dependencies to see if this vulnerability affects your projects.
Scan Your Dependencies