7.8

CVE-2019-1069

Warnung
Exploit

An elevation of privilege vulnerability exists in the way the Task Scheduler Service validates certain file operations. An attacker who successfully exploited the vulnerability could gain elevated privileges on a victim system.
To exploit the vulnerability, an attacker would require unprivileged code execution on a victim system.
The security update addresses the vulnerability by correctly validating file operations.

Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Microsoft ≫ Windows 10 1507 Version-
Microsoft ≫ Windows 10 1607 Version-
Microsoft ≫ Windows 10 1703 Version-
Microsoft ≫ Windows 10 1709 Version-
Microsoft ≫ Windows 10 1803 Version-
Microsoft ≫ Windows 10 1809 Version-
Microsoft ≫ Windows 10 1903 Version-

15.03.2022: CISA Known Exploited Vulnerabilities (KEV) Catalog

Microsoft Task Scheduler Privilege Escalation Vulnerability

Schwachstelle

A privilege escalation vulnerability exists in the way the Task Scheduler Service validates certain file operations.

Beschreibung

Apply updates per vendor instructions.

Erforderliche Maßnahmen
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 29.84% 0.965
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 7.2 3.9 10
AV:L/AC:L/Au:N/C:C/I:C/A:C
134c704f-9b21-4f2e-91b3-4a467353bcc0 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
secure@microsoft.com 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-59 Improper Link Resolution Before File Access ('Link Following')

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

https://www.kb.cert.org/vuls/id/119704
Third Party Advisory
US Government Resource