CVE-2020-1147

Why Does One CVE Cover Three Different Microsoft Products?

.NET Framework, SharePoint, and Visual Studio don't share a codebase, but they do share a common underlying XML-processing component used for deserializing structured data. When a vulnerability lives in shared infrastructure like this rather than in any one product's own code, Microsoft ships and discloses the fix across every product line that depends on the vulnerable component simultaneously — a pattern also seen in other shared-dependency vulnerabilities like Log4Shell and the Oracle Coherence bugs also covered on this site.

Overview

CVE-2020-1147 is a remote code execution vulnerability arising when software fails to check the source markup of XML file input before processing it. An attacker who can get a vulnerable application to process a maliciously crafted XML file can trigger unsafe deserialization, executing code in the context of whatever process is handling that XML content (CVSS 3.1: AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 7.8 High) — the "Local" attack vector and required user interaction reflect that exploitation typically requires the victim to open or process a malicious file locally, rather than a purely remote, unauthenticated network attack.

Technical Details

The flaw is in how the shared component validates (or fails to validate) the structure and source of XML markup before deserializing it into objects. Because .NET Framework, SharePoint, and Visual Studio each rely on this same underlying processing path for different purposes — application data handling, document/list processing, and project file handling respectively — a single flaw manifests as an RCE opportunity across all three, each requiring the application in question to process attacker-supplied XML content.

Discovery

Patched as part of Microsoft's routine July 2020 Patch Tuesday release, addressing the shared vulnerability across all three affected products in a single coordinated disclosure.

Exploitation Context

CISA added this CVE to KEV in November 2021 based on confirmed exploitation. Because the vulnerability requires a victim to open or process a malicious file, real-world exploitation likely occurs via social engineering — a malicious file disguised as a legitimate document, project file, or SharePoint list import, delivered via phishing or a compromised file-sharing location.

Remediation

1. Apply Microsoft's July 2020 Patch Tuesday updates for .NET Framework, SharePoint, and Visual Studio — all three need patching independently, since each ships its own copy of the affected component.
2. Be cautious opening XML-based files, project files, or SharePoint imports from untrusted or unverified sources, since exploitation requires the victim to process malicious XML content.
3. Inventory which of the three affected products are deployed in your environment — an organization might patch SharePoint promptly while overlooking that Visual Studio installations on developer workstations also need the same update.
4. Train users on the risks of opening unsolicited document or project files, given this vulnerability's dependence on user interaction as the initial trigger.