Microsoft SharePoint server has a new vulnerability: CVE-2020-16952. It can be exploited when a user uploads a specially crafted application package to an affected version of the software

Microsoft SharePoint server ha a new vulnerability, the CVE-2020-16952, that could let an attacker take control of an affected system. It has been unveiled by the United Kingdom National CyberSecurity Centre (NCSC). According the experts, it is a caused by a validation issue in user-supplied data. This flaw can be exploited by cybercrime actors when a user uploads a specially crafted application package to an affected version of SharePoint. The affected versions are:

Microsoft SharePoint Foundation 2013 Service Pack 1

Microsoft SharePoint Enterprise Server 2016

Microsoft SharePoint Server 2019

However, SharePoint Online as part of Office 365 is not affected. The October 2020 SharePoint security update addresses the vulnerability by correcting how SharePoint checks the source markup of application packages. Furthermore, Microsoft published an advisory wich inludes links to these updates.