CVE-2020-1159: 
vulnerability analysis and mitigation

An elevation of privilege vulnerability (CVE-2020-1159) exists in the way that the StartTileData.dll handles file creation in protected locations. The vulnerability was discovered in 2019 and affects various versions of Microsoft Windows 10 and Windows Server 2016. This vulnerability is unique from CVE-2020-1052 and CVE-2020-1376 (NVD).

The vulnerability received a CVSS v3.1 base score of 7.8 (HIGH) from NIST and 6.6 (MEDIUM) from Microsoft. The vulnerability requires local access (AV:L), low attack complexity (AC:L), low privileges (PR:L), and no user interaction (UI:N). The scope is unchanged (S:U), with high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H) according to NIST's assessment (NVD).

If successfully exploited, an attacker could execute code with elevated permissions, potentially gaining higher privileges on the affected system. The vulnerability affects multiple versions of Windows systems, including Windows 10 versions 1903, 1909, 2004, and corresponding Windows Server 2016 versions (NVD).

To exploit the vulnerability, a locally authenticated attacker would need to run a specially crafted application. The attack requires local access to the system and low privileges to execute (CVE).

Microsoft has released a security update that addresses the vulnerability by ensuring the StartTileData.dll properly handles file creation in protected locations. Users should apply the available security patches to mitigate this vulnerability (CVE).