CVE-2020-17000: 
vulnerability analysis and mitigation

Remote Desktop Protocol Client Information Disclosure Vulnerability (CVE-2020-17000) was disclosed and patched as part of Microsoft's November 2020 Patch Tuesday security updates. This vulnerability affects various versions of Microsoft Windows, including Windows 10 and Windows Server systems (Bleeping Computer).

The vulnerability is classified with a CVSS 3.1 Base Score of 5.5 (MEDIUM) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. Under CVSS 2.0, it received a Base Score of 2.1 (LOW) with the vector (AV:L/AC:L/Au:N/C:P/I:N/A:N) (NVD).

This vulnerability could allow an attacker to obtain information disclosure through the Remote Desktop Protocol Client. The vulnerability affects confidentiality but does not impact system integrity or availability, as indicated by the CVSS scoring (NVD).

The vulnerability requires local access and low privilege levels to exploit, as indicated by the CVSS vector string. No public exploits or active exploitation in the wild were reported at the time of disclosure (NVD).

Microsoft addressed this vulnerability in the November 2020 Patch Tuesday security updates. Users and administrators should apply the relevant security updates to affected systems through Windows Update or by downloading and installing the patches manually (Bleeping Computer).