Intrusion PreventionMS.SharePoint.Server.Web.Parts.Remote.Code.Execution
Description
This indicates an attack attempt to exploit a Remote Code Execution Vulnerability in Microsoft Sharepoint Server.
he vulnerability is due to lack of validation of the "ObjectDataSource" control by the function AllowControl(). A remote attacker could exploit this vulnerability by creating and invoking a specially crafted Web Part. Successful exploitation results in the execution of arbitrary code in the context of service account.
Affected Products
Microsoft SharePoint Enterprise Server 2016
Microsoft SharePoint Foundation 2010 Service Pack 2
Microsoft SharePoint Foundation 2013 Service Pack 1
Microsoft Sharepoint Server 2019
Impact
System Compromise: Remote attackers can gain control of vulnerable systems.
Recommended Actions
Apply the most recent upgrade or patch from the vendor.
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1181
Telemetry
Coverage
| IPS (Regular DB) | |
| IPS (Extended DB) |
| ID | 49349 |
| Created | Aug 04, 2020 |
| Updated | Aug 25, 2020 |
| Risk |
|
| CVE ID | CVE-2020-1181 |
| Exploit Prediction Score | 36.35% |
| Default Action | drop |
| Active | |
| Affected OS | Windows |
| Affected App | Other |