CVE-2020-16952

<p>A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the SharePoint application pool and the SharePoint server farm account.</p> <p>Exploitation of this vulnerability requires that a user uploads a specially crafted SharePoint application package to an affected version of SharePoint.</p> <p>The security update addresses the vulnerability by correcting how SharePoint checks the source markup of application packages.</p>

• CWE-346

• http://packetstormsecurity.com/files/159612/Microsoft-SharePoint-SSI-ViewState-Remote-Code-Execution.htmlExploit, Third Party Advisory
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16952Patch, Vendor Advisory
• http://packetstormsecurity.com/files/159612/Microsoft-SharePoint-SSI-ViewState-Remote-Code-Execution.htmlExploit, Third Party Advisory
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16952Patch, Vendor Advisory

Published

Oct 16, 2020

Last Modified

Jun 17, 2026

Status

Modified

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-16947<p>A remote code execution vulnerability exists in Microsoft…7.5
• CVE-2020-16948<p>An information disclosure vulnerability exists when Micro…6.5
• CVE-2020-16949<p>A denial of service vulnerability exists in Microsoft Out…4.7
• CVE-2020-1695A flaw was found in all resteasy 3.x.x versions prior to 3.1…7.5
• CVE-2020-16950<p>An information disclosure vulnerability exists when Micro…5
• CVE-2020-16951<p>A remote code execution vulnerability exists in Microsoft…8.6
• CVE-2020-16953<p>An information disclosure vulnerability exists when Micro…6.5
• CVE-2020-16954<p>A remote code execution vulnerability exists in Microsoft…7.8
• CVE-2020-16955<p>An elevation of privilege vulnerability exists in the way…7.8
• CVE-2020-16956<p>A cross site scripting vulnerability exists when Microsof…5.4
• CVE-2020-16957<p>A remote code execution vulnerability exists when the Mic…7.8
• CVE-2020-16958Windows Backup Engine Elevation of Privilege Vulnerability7.8