CVE-2020-1203: 
vulnerability analysis and mitigation

An elevation of privilege vulnerability (CVE-2020-1203) exists in the Diagnostics Hub Standard Collector and Visual Studio Standard Collector when they fail to properly handle objects in memory. This vulnerability was disclosed on June 9, 2020, affecting multiple versions of Microsoft Visual Studio (2015 Update 3, 2017, and 2019) and various Windows 10 versions (NVD).

The vulnerability received a CVSS v3.1 base score of 7.8 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating local access requirements with low attack complexity and no user interaction needed. The CVSS v2.0 base score was assessed at 7.2 (HIGH) with the vector (AV:L/AC:L/Au:N/C:C/I:C/A:C) (NVD).

If successfully exploited, this vulnerability could allow an attacker to gain elevated privileges on affected systems. The high severity ratings across both CVSS versions indicate potential complete compromise of system confidentiality, integrity, and availability (NVD).

The vulnerability requires local access to exploit, with low attack complexity and no authentication needed. This makes it relatively straightforward to exploit for attackers who have already gained local access to affected systems (NVD).

Microsoft released security updates to address this vulnerability. For Visual Studio 2015 Update 3, users must have both Visual Studio 2015 Update 3 and the Cumulative Servicing Release KB 3165756 installed before applying the security update. It is recommended to close Visual Studio 2015 before installing the security update to avoid potential system restarts (Microsoft Support).