What is the CVSS score of CVE-2020-16901?

CVE-2020-16901 has a CVSS 3.1 base score of 5.0 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 1.5%.

Which versions of Windows Server 2016 are affected by CVE-2020-16901?

An information disclosure vulnerability exists when the Windows kernel improperly initializes objects in memory. To exploit this vulnerability, an authenticated attacker could run a.. A patch is available.

Is there a patch available for CVE-2020-16901?

Yes, a patch is available for CVE-2020-16901. Update the affected software to the latest version immediately.

Windows Server 2016 CVE-2020-16901

MEDIUM

Improper Initialization (CWE-665)

2020-10-16 secure@microsoft.com

Information Disclosure Microsoft Windows Server 2016 Windows 10

5.0

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

5.0 MEDIUM

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Primary rating from Vendor (microsoft) · only source for this CVE.

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

CVE Published

Oct 16, 2020 - 23:15 cve.org

MEDIUM 5.0

DescriptionCVE.org

An information disclosure vulnerability exists when the Windows kernel improperly initializes objects in memory. To exploit this vulnerability, an authenticated attacker could run a specially crafted application. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user’s system. The update addresses the vulnerability by correcting how the Windows kernel initializes objects in memory.

AnalysisAI

Technical ContextAI

This vulnerability is classified under CWE-665. An information disclosure vulnerability exists when the Windows kernel improperly initializes objects in memory. To exploit this vulnerability, an authenticated attacker could run a specially crafted application. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user’s system. The update addresses the vulnerability by correcting how the Windows kernel initializes objects in memory. Affected products include: Microsoft Windows 10, Microsoft Windows Server 2016.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.