PT-2020-4250 · Microsoft · Remote Desktop Services+2

Published 2020-10-13 · Updated 2023-12-31 · CVE-2020-16896

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Remote Desktop Protocol (RDP) (affected versions not specified)

Description: An information disclosure issue exists in Remote Desktop Protocol (RDP) when an attacker connects to the target system using RDP and sends specially crafted requests. This could allow an attacker to obtain information to further compromise the user's system. To exploit this issue, an attacker would need to run a specially crafted application against a server that provides RDP services. The vulnerability is due to insufficient input validation in Remote Desktop Services (RDS) in Windows operating systems, which could allow a remote attacker to gain unauthorized access to protected information.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2020-04710

CVE-2020-16896

Affected Products

Remote Desktop Protocol

Remote Desktop Services

Windows

References · 7

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16896 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-16896 · Security Note
• https://osv.dev/vulnerability/CVE-2020-16896 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2020-16896 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-04710 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16896 · Security Note
• https://cybersecurity-help.cz/vdb/SB2020101352 · Note