Very Low
CVE-2020-1296 Windows Diagnostics & feedback Information Disclosure Vulnerability
CVE ID
AttackerKB requires a CVE ID in order to pull vulnerability data and references from the CVE list and the National Vulnerability Database. If available, please supply below:
Add References:
CVE-2020-1296 Windows Diagnostics & feedback Information Disclosure Vulnerability
MITRE ATT&CK
Collection
Command and Control
Credential Access
Defense Evasion
Discovery
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation
Description
A vulnerability exists in the way the Windows Diagnostics & feedback settings app handles objects in memory, aka ‘Windows Diagnostics & feedback Information Disclosure Vulnerability’.
Add Assessment
Ratings
-
Attacker ValueVery Low
-
ExploitabilityVery Low
Technical Analysis
This is more embarrassing for Microsoft than something to worry about from an attacker. I’m curious though what data folks didn’t expect Microsoft to get from something called ‘Windows Diagnostics and Feedback’. I always just assumed it was minidumps in the first place, so plenty was already disclosed. Tricky line to draw in the sand.
Would you also like to delete your Exploited in the Wild Report?
Delete Assessment Only Delete Assessment and Exploited in the Wild ReportCVSS V3 Severity and Metrics
General Information
Vendors
- Microsoft
Products
- Windows,
- Windows Server,
- Windows 10 Version 1909 for 32-bit Systems,
- Windows 10 Version 1909 for x64-based Systems,
- Windows 10 Version 1909 for ARM64-based Systems,
- Windows Server, version 1909 (Server Core installation),
- Windows 10 Version 1903 for 32-bit Systems,
- Windows 10 Version 1903 for x64-based Systems,
- Windows 10 Version 1903 for ARM64-based Systems,
- Windows Server, version 1903 (Server Core installation),
- Windows 10 Version 2004 for ARM64-based Systems,
- Windows 10 Version 2004 for 32-bit Systems,
- Windows Server, version 2004 (Server Core installation),
- Windows 10 Version 2004 for x64-based Systems
References
Additional Info
Technical Analysis
Report as Exploited in the Wild
CVE ID
AttackerKB requires a CVE ID in order to pull vulnerability data and references from the CVE list and the National Vulnerability Database. If available, please supply below:
