CVE-2020-16937 : An information disclosure vulnerability exists when the .NET Framework improp

An information disclosure vulnerability exists when the .NET Framework improperly handles objects in memory. An attacker who successfully exploited the vulnerability could disclose contents of an affected system's memory. To exploit the vulnerability, an authenticated attacker would need to run a specially crafted application. The update addresses the vulnerability by correcting how the .NET Framework handles objects in memory.

Published 2020-10-16 23:15:16

Updated 2023-12-31 20:15:55

Source Microsoft Corporation

View at NVD, CVE.org

Vulnerability category: Information leak

Products affected by CVE-2020-16937

Microsoft » .net Framework » Version: 2.0 Update SP2
cpe:2.3:a:microsoft:.net_framework:2.0:sp2:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows Server 2008 » Version: N/A Update SP2
Microsoft » .net Framework » Version: 3.5
cpe:2.3:a:microsoft:.net_framework:3.5:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows 8.1 » Version: N/A
When used together with: Microsoft » Windows Server 2012 » Version: N/A
When used together with: Microsoft » Windows Server 2012 » Version: R2
Microsoft » .net Framework » Version: 3.5.1
cpe:2.3:a:microsoft:.net_framework:3.5.1:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows 7 » Version: N/A Update SP1
When used together with: Microsoft » Windows Server 2008 » Version: R2 Update SP1
Microsoft » .net Framework » Version: 4.5.2
cpe:2.3:a:microsoft:.net_framework:4.5.2:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows 7 » Version: N/A Update SP1
When used together with: Microsoft » Windows 8.1 » Version: N/A
When used together with: Microsoft » Windows Rt 8.1 » Version: N/A
When used together with: Microsoft » Windows Server 2008 » Version: N/A Update SP2
When used together with: Microsoft » Windows Server 2008 » Version: R2 Update SP1
When used together with: Microsoft » Windows Server 2012 » Version: N/A
When used together with: Microsoft » Windows Server 2012 » Version: R2
Microsoft » .net Framework » Version: 4.6
cpe:2.3:a:microsoft:.net_framework:4.6:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows 10 » Version: N/A
Microsoft » .net Framework » Version: 4.6.1
cpe:2.3:a:microsoft:.net_framework:4.6.1:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows 10 » Version: N/A
Microsoft » .net Framework » Version: 4.6.2
cpe:2.3:a:microsoft:.net_framework:4.6.2:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows 10 » Version: 1607
When used together with: Microsoft » Windows Server 2016 » Version: N/A
Microsoft » .net Framework » Version: 4.7
cpe:2.3:a:microsoft:.net_framework:4.7:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows 10 » Version: 1607
When used together with: Microsoft » Windows Server 2016 » Version: N/A
Microsoft » .net Framework » Version: 4.7.1
cpe:2.3:a:microsoft:.net_framework:4.7.1:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows 10 » Version: 1607
When used together with: Microsoft » Windows Server 2016 » Version: N/A
Microsoft » .net Framework » Version: 4.7.2
cpe:2.3:a:microsoft:.net_framework:4.7.2:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows 10 » Version: 1607
When used together with: Microsoft » Windows Server 2016 » Version: N/A
Microsoft » .net Framework » Version: 4.8
cpe:2.3:a:microsoft:.net_framework:4.8:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows 10 » Version: 1809
When used together with: Microsoft » Windows 10 » Version: 1903
When used together with: Microsoft » Windows 10 » Version: 1909
When used together with: Microsoft » Windows 10 » Version: 2004
When used together with: Microsoft » Windows Server 2016 » Version: 1903
When used together with: Microsoft » Windows Server 2016 » Version: 1909
When used together with: Microsoft » Windows Server 2016 » Version: 2004
When used together with: Microsoft » Windows Server 2019 » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2020-16937

EPSS FAQ

4.28%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 88 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2020-16937

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.3	MEDIUM	AV:N/AC:M/Au:N/C:P/I:N/A:N	8.6	2.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
5.5	MEDIUM	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N	1.8	3.6	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Unchanged Confidentiality: High Integrity: None Availability: None
4.7	MEDIUM	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N	1.0	3.6	Microsoft Corporation
Attack Vector: Local Attack Complexity: High Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None

References for CVE-2020-16937

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16937

CVE-2020-16937 | .NET Framework Information Disclosure Vulnerability
Patch;Vendor Advisory

Jump to

Vulnerability Details : CVE-2020-16937

Products affected by CVE-2020-16937

Exploit prediction scoring system (EPSS) score for CVE-2020-16937

CVSS scores for CVE-2020-16937

References for CVE-2020-16937