PT-2020-4822 · Microsoft · Windows+1

Published 2020-11-10 · Updated 2023-12-31 · CVE-2020-17090

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Windows (affected versions not specified) Microsoft Defender for Endpoint (affected versions not specified)

Description: The issue is related to errors in security settings, allowing a remote attacker to exploit it and potentially disclose protected information. It is a security-feature bypass vulnerability that enables attackers to affect the system.

Recommendations: For Windows, consider applying security patches or configuration changes to fix errors in security settings until a specific fix is provided. For Microsoft Defender for Endpoint, restrict access to security features to minimize the risk of exploitation until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-254

CWE-200

Related Identifiers

BDU:2020-05375

CVE-2020-17090

Affected Products

Defender For Endpoint

Windows

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2020-17090 · Security Note
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2020-17090 · Vendor Advisory
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-17090 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-05375 · Security Note
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2020-17090 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-17090 · Security Note
• https://osv.dev/vulnerability/CVE-2020-17090 · Vendor Advisory
• https://cybersecurity-help.cz/vdb/SB2020111068 · Note