CVE-2020-17138: 
vulnerability analysis and mitigation

Windows Error Reporting Information Disclosure Vulnerability (CVE-2020-17138) was identified and disclosed on December 9, 2020. This vulnerability affects Microsoft Windows systems, specifically Windows 10 version 1607 and Windows Server 2016 (NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (MEDIUM) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, indicating local access is required, low attack complexity, and potential for high confidentiality impact without affecting integrity or availability. Under CVSS v2.0, it received a base score of 2.1 (LOW) with vector (AV:L/AC:L/Au:N/C:P/I:N/A:N) (NVD).

The vulnerability could lead to information disclosure in Windows Error Reporting system. When successfully exploited, it allows an attacker with local access to obtain sensitive information, potentially compromising the confidentiality of system data (NVD).

The vulnerability requires local access and low attack complexity to exploit. No known exploits in the wild have been publicly reported at the time of assessment (NVD).

Microsoft has released security updates to address this vulnerability. Users are advised to apply the available patches through the Microsoft security advisory (Microsoft Advisory).