CVE-2020-16941: 
vulnerability analysis and mitigation

An information disclosure vulnerability (CVE-2020-16941) exists in Microsoft SharePoint Server that improperly discloses its folder structure when rendering specific web pages. The vulnerability was disclosed and patched as part of Microsoft's October 2020 security updates. This vulnerability affects multiple versions of SharePoint, including SharePoint Enterprise Server 2016, SharePoint Foundation 2010 SP2, SharePoint Foundation 2013 SP1, and SharePoint Server 2019 (NVD).

The vulnerability allows an attacker to view the folder path of scripts loaded on affected SharePoint pages. The severity is rated as MEDIUM with a CVSS v3.1 base score of 5.5 according to NVD, while Microsoft rates it at 4.1. The vulnerability requires local access and has a high complexity rating. The CVSS vector string is CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N, indicating local access is required with high attack complexity (NVD).

The vulnerability could allow an attacker to view the folder path of scripts loaded on the page, potentially exposing sensitive information about the SharePoint server's file structure. However, the attacker would need to have access to the specific SharePoint page affected by this vulnerability to exploit it (NVD).

To exploit this vulnerability, an attacker would require access to the specific SharePoint page affected by the vulnerability. The attack complexity is rated as high, and local access is required, making exploitation more difficult (NVD).

Microsoft addressed this vulnerability by releasing security updates that correct how scripts are referenced on some SharePoint pages. The fix was included in the October 13, 2020 security updates for affected SharePoint versions (Microsoft Support).