CVE-2020-1502: 
vulnerability analysis and mitigation

An information disclosure vulnerability (CVE-2020-1502) was identified in Microsoft Word that improperly discloses the contents of its memory. The vulnerability was discovered and assigned on November 4, 2019, and affects multiple Microsoft products including Microsoft 365 Apps Enterprise, Office 2019, Office Online Server, and SharePoint Server 2019 (NVD Database).

The vulnerability received a CVSS v3.1 base score of 5.5 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. The vulnerability requires user interaction and local access, but no privileges are needed for exploitation. While it has high confidentiality impact, it does not affect integrity or availability (NVD Database).

If successfully exploited, this vulnerability could allow an attacker to access sensitive information from the system's memory, potentially leading to the compromise of the user's computer or data. The attack requires the attacker to craft a special document file and convince the user to open it, with the additional requirement that the attacker must know the memory address location where the object was created (CVE Details).

The vulnerability requires an attacker to craft a special document file and convince the user to open it. Additionally, the attacker must have knowledge of the specific memory address location where the target object was created, making successful exploitation more challenging (NVD Database).

Microsoft addressed this vulnerability by releasing a security update that changes the way certain Word functions handle objects in memory. The fix was included in the August 11, 2020 security updates. Users can obtain the update through Microsoft Update, Microsoft Update Catalog, or the Microsoft Download Center (Microsoft Support).