CVE-2020-1368: 
vulnerability analysis and mitigation

An elevation of privilege vulnerability (CVE-2020-1368) was identified in the Windows Credential Enrollment Manager service. The vulnerability was discovered in how the service handles objects in memory, officially named 'Windows Credential Enrollment Manager Service Elevation of Privilege Vulnerability'. The vulnerability was recorded on November 4, 2019, and publicly disclosed on July 14, 2020 (NVD, CVE Mitre).

The vulnerability has been assigned a CVSS score of 5.0, indicating a medium severity level. The attack vector is local (AV:L), with low attack complexity (AC:L), requiring no authentication (Au:N), and potentially impacting partial confidentiality, integrity, and availability (C:P/I:P/A:P) (Rapid7).

This vulnerability could allow an attacker to gain elevated privileges on affected systems through the exploitation of the Credential Enrollment Manager service's memory handling mechanism (NVD).

The vulnerability requires local access to the system for exploitation. An attacker would need to run a specially crafted application to take advantage of the vulnerability in the Windows Credential Enrollment Manager service (Rapid7).

Microsoft has released security updates to address this vulnerability. The fixes are available through various KB updates including KB4565513, KB4565511, KB4565508, KB4565489, KB4558998, KB4565483, KB4565503, and KB4565540, covering multiple versions of Windows 10 and Windows Server (Rapid7).