7.8

CVE-2019-1253

Warnung

An elevation of privilege vulnerability exists when the Windows AppX Deployment Server improperly handles junctions.To exploit this vulnerability, an attacker would first have to gain execution on the victim system, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1215, CVE-2019-1278, CVE-2019-1303.

Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Microsoft ≫ Windows 10 1703 Version- HwPlatformx64
Microsoft ≫ Windows 10 1703 Version- HwPlatformx86
Microsoft ≫ Windows 10 1709 Version- HwPlatformarm64
Microsoft ≫ Windows 10 1709 Version- HwPlatformx64
Microsoft ≫ Windows 10 1709 Version- HwPlatformx86
Microsoft ≫ Windows 10 1803 Version- HwPlatformarm64
Microsoft ≫ Windows 10 1803 Version- HwPlatformx64
Microsoft ≫ Windows 10 1803 Version- HwPlatformx86
Microsoft ≫ Windows 10 1809 Version- HwPlatformarm64
Microsoft ≫ Windows 10 1809 Version- HwPlatformx64
Microsoft ≫ Windows 10 1809 Version- HwPlatformx86
Microsoft ≫ Windows 10 1903 Version- HwPlatformarm64
Microsoft ≫ Windows 10 1903 Version- HwPlatformx64
Microsoft ≫ Windows 10 1903 Version- HwPlatformx86
Microsoft ≫ Windows Server 1903 Version- HwPlatformx64

15.03.2022: CISA Known Exploited Vulnerabilities (KEV) Catalog

Microsoft Windows AppX Deployment Server Privilege Escalation Vulnerability

Schwachstelle

A privilege escalation vulnerability exists when the Windows AppX Deployment Server improperly handles junctions.

Beschreibung

Apply updates per vendor instructions.

Erforderliche Maßnahmen
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 23.63% 0.958
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 7.2 3.9 10
AV:L/AC:L/Au:N/C:C/I:C/A:C
134c704f-9b21-4f2e-91b3-4a467353bcc0 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-59 Improper Link Resolution Before File Access ('Link Following')

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.