CVE-2020-16942: 
vulnerability analysis and mitigation

CVE-2020-16942 is an information disclosure vulnerability that exists when Microsoft SharePoint Server improperly discloses its folder structure when rendering specific web pages. The vulnerability was disclosed and patched in October 2020. This vulnerability affects multiple versions of SharePoint, including SharePoint Enterprise Server 2016, SharePoint Foundation 2010 SP2, and SharePoint Foundation 2013 SP1 (NVD).

The vulnerability allows an attacker to view the folder path of scripts loaded on the page when SharePoint Server improperly discloses its folder structure during web page rendering. The vulnerability has been assigned a CVSS v3.1 Base Score of 4.4 (MEDIUM) with vector CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N by NIST, and a score of 4.1 (MEDIUM) by Microsoft with vector CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N (NVD).

An attacker who successfully exploits this vulnerability could view the folder path of scripts loaded on the affected SharePoint page. However, to exploit the vulnerability, an attacker would require access to the specific SharePoint page affected by this vulnerability (NVD).

The vulnerability requires local access and high privileges to exploit. The attacker would need access to the specific SharePoint page affected by the vulnerability. There are no known exploits of this vulnerability in the wild at the time of disclosure (NVD).

Microsoft has released security updates that address this vulnerability by correcting how scripts are referenced on some SharePoint pages. The fix is included in the October 13, 2020 security updates for affected SharePoint versions (Microsoft Support).