Summaryinfo

A vulnerability, which was classified as problematic, was found in Microsoft Windows 10 1903/10 1909/Server 1903/Server 1909/Server 2019. The affected element is an unknown function of the component GDI. Such manipulation leads to information disclosure. This vulnerability is referenced as CVE-2020-1145. It is possible to launch the attack remotely. No exploit is available. It is best practice to apply a patch to resolve this issue.

Detailsinfo

A vulnerability was found in Microsoft Windows 10 1903/10 1909/Server 1903/Server 1909/Server 2019 (Operating System). It has been rated as problematic. Affected by this issue is some unknown functionality of the component GDI. The manipulation with an unknown input leads to a information disclosure vulnerability. Using CWE to declare the problem leads to CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. Impacted is confidentiality. CVE summarizes:

An information disclosure vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in memory, allowing an attacker to retrieve information from a targeted system, aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-0963, CVE-2020-1141, CVE-2020-1179.

The weakness was published 05/12/2020 as confirmed security update guide (Website). The advisory is available at portal.msrc.microsoft.com. The public release has been coordinated with the vendor. This vulnerability is handled as CVE-2020-1145. The attack may be launched remotely. A simple authentication is required for exploitation. The technical details are unknown and an exploit is not available. This vulnerability is assigned to T1592 by the MITRE ATT&CK project. The advisory points out:

An information disclosure vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in memory, allowing an attacker to retrieve information from a targeted system. By itself, the information disclosure does not allow arbitrary code execution; however, it could allow arbitrary code to be run if the attacker uses it in combination with another vulnerability.

Applying a patch is able to eliminate this problem. A possible mitigation has been published immediately after the disclosure of the vulnerability.

Similar entries are available at VDB-155154, VDB-155153, VDB-155152 and VDB-155151. If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Operating System

Vendor

• Microsoft

Name

• Windows

Version

• 10 1903
• 10 1909
• Server 1903
• Server 1909
• Server 2019

License

• commercial

Website

• Vendor: https://www.microsoft.com/
• Product: https://www.microsoft.com/en-us/windows

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion