CVE-2020-16879: 
vulnerability analysis and mitigation

An information disclosure vulnerability (CVE-2020-16879) exists in Windows Projected Filesystem when it improperly handles file redirections. The vulnerability was assigned by Microsoft Corporation on August 4, 2020, and affects multiple versions of Windows 10 and Windows Server (NVD CVE).

The vulnerability has been assigned a CVSS v3.1 Base Score of 5.5 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. This indicates local access is required, with low attack complexity and privileges required, no user interaction needed, and the scope is unchanged. The impact primarily affects confidentiality, with no impact on integrity or availability (NVD CVE).

When successfully exploited, this vulnerability could allow an attacker to obtain information that could be used to further compromise the user's system. The vulnerability specifically affects the information disclosure aspect of security, potentially exposing sensitive data (MITRE CVE).

To exploit this vulnerability, an attacker would first need to log on to the system. Once logged in, they could run a specially crafted application that could exploit the vulnerability. The attack requires local access, making remote exploitation impossible (NVD CVE).

Microsoft has released a security update that addresses the vulnerability by correcting how Windows Projected Filesystem handles file redirections. The fix is available for affected systems including Windows 10 versions 1809, 1903, 1909, 2004, and Windows Server 2016 and 2019 (NVD CVE).