CVE-2020-1505: 
vulnerability analysis and mitigation

An information disclosure vulnerability (CVE-2020-1505) exists in Microsoft SharePoint Server when it fails to properly handle objects in memory. The vulnerability was disclosed on August 17, 2020, affecting multiple versions of SharePoint including SharePoint Enterprise Server 2016, SharePoint Foundation 2013 SP1, SharePoint Server 2010 SP2, and SharePoint Server 2019 (NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. This indicates that the vulnerability requires local access, low attack complexity, low privileges, and no user interaction to exploit. The vulnerability can lead to high confidentiality impact but does not affect integrity or availability (NVD).

If successfully exploited, this vulnerability could allow an attacker to obtain sensitive information that could be used to further compromise the user's system. The attack requires the attacker to log on to the affected system and run a specially crafted application (NVD).

To exploit the vulnerability, an attacker would need to have local access to the affected system and the ability to run a specially crafted application. The vulnerability requires low attack complexity and low privileges to exploit (NVD).

Microsoft has released a security update that addresses the vulnerability by correcting how Microsoft SharePoint Server handles objects in memory. The fix is included in the August 11, 2020 security updates for affected SharePoint versions (Microsoft Support).