Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2020-1487

An information disclosure vulnerability exists when Media Foundation improperly handles objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user’s system. To exploit this vulnerability, an attacker would have to log onto an affected system and open a specially crafted file. In a web-based attack scenario, an attacker could host a website (or leverage a compromised website that accepts or hosts user-provided content) that contains a specially crafted file that is designed to exploit the vulnerability. However, an attacker would have no way to force the user to visit the website. Instead, an attacker would have to convince the user to click a link, typically by way of an enticement in an email or Instant Messenger message, and then convince the user to open the specially crafted file. The update addresses the vulnerability by correcting how Media Foundation handles objects in memory.

Published

2020-08-17T19:15:15.927

Last Modified

2024-11-21T05:10:39.927

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 7.8 (HIGH)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

  • Access Vector: NETWORK
  • Access Complexity: MEDIUM
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: NONE
  • Availability Impact: NONE
Exploitability Score

8.6

Impact Score

2.9

Weaknesses
  • Type: Primary
    NVD-CWE-noinfo
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Operating System microsoft windows_10 - Yes
Operating System microsoft windows_10 1607 Yes
Operating System microsoft windows_10 1709 Yes
Operating System microsoft windows_10 1803 Yes
Operating System microsoft windows_10 1809 Yes
Operating System microsoft windows_10 1903 Yes
Operating System microsoft windows_10 1909 Yes
Operating System microsoft windows_10 2004 Yes
Operating System microsoft windows_8.1 - Yes
Operating System microsoft windows_rt_8.1 - Yes
Operating System microsoft windows_server_2012 r2 Yes
Operating System microsoft windows_server_2016 - Yes
Operating System microsoft windows_server_2016 1903 Yes
Operating System microsoft windows_server_2016 1909 Yes
Operating System microsoft windows_server_2016 2004 Yes
Operating System microsoft windows_server_2019 - Yes
References