CVE-2020-16937

.NET Framework Information Disclosure Vulnerability

Description

An information disclosure vulnerability exists when the .NET Framework improperly handles objects in memory. An attacker who successfully exploited the vulnerability could disclose contents of an affected system's memory. To exploit the vulnerability, an authenticated attacker would need to run a specially crafted application. The update addresses the vulnerability by correcting how the .NET Framework handles objects in memory.

4.7

CVSS

Severity: Medium

CVSS 3.1 •

CVSS 2.0 •

EPSS 4.28% Top 15%

Vendor Advisory microsoft.com

Affected: Microsoft Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2

Affected: Microsoft Microsoft .NET Framework 4.8

Affected: Microsoft Microsoft .NET Framework 3.5 AND 4.8

Affected: Microsoft Microsoft .NET Framework 3.5 AND 4.7.2

Affected: Microsoft Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2

Affected: Microsoft Microsoft .NET Framework 3.5 AND 4.7.1/4.7.2

Affected: Microsoft Microsoft .NET Framework 3.5 AND 4.6/4.6.1/4.6.2

Affected: Microsoft Microsoft .NET Framework 4.6

Affected: Microsoft Microsoft .NET Framework 2.0 Service Pack 2

Affected: Microsoft Microsoft .NET Framework 3.5

Affected: Microsoft Microsoft .NET Framework 3.5.1

Affected: Microsoft Microsoft .NET Framework 4.5.2

References

Link	Tags
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16937	patch vendor advisory

Frequently Asked Questions

What is the severity of CVE-2020-16937?: CVE-2020-16937 has been scored as a medium severity vulnerability.
How to fix CVE-2020-16937?: To fix CVE-2020-16937, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2020-16937 being actively exploited in the wild?: It is possible that CVE-2020-16937 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~4% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2020-16937?: CVE-2020-16937 affects Microsoft Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2, Microsoft Microsoft .NET Framework 4.8, Microsoft Microsoft .NET Framework 3.5 AND 4.8, Microsoft Microsoft .NET Framework 3.5 AND 4.7.2, Microsoft Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2, Microsoft Microsoft .NET Framework 3.5 AND 4.7.1/4.7.2, Microsoft Microsoft .NET Framework 3.5 AND 4.6/4.6.1/4.6.2, Microsoft Microsoft .NET Framework 4.6, Microsoft Microsoft .NET Framework 2.0 Service Pack 2, Microsoft Microsoft .NET Framework 3.5, Microsoft Microsoft .NET Framework 3.5.1, Microsoft Microsoft .NET Framework 4.5.2.