7.8

CVE-2023-36874

Warning
Exploit

Windows Error Reporting Service Elevation of Privilege Vulnerability

Data is provided by the National Vulnerability Database (NVD)
Microsoft ≫ Windows 10 1507 Version < 10.0.10240.20048
Microsoft ≫ Windows 10 1607 HwPlatformx64 Version < 10.0.14393.6085
Microsoft ≫ Windows 10 1607 HwPlatformx86 Version < 10.0.14393.6085
Microsoft ≫ Windows 10 1809 Version < 10.0.17763.4645
Microsoft ≫ Windows 10 1809 HwPlatformarm64 Version < 10.0.17763.4645
Microsoft ≫ Windows 10 1809 HwPlatformx64 Version < 10.0.17763.4645
Microsoft ≫ Windows 10 1809 HwPlatformx86 Version < 10.0.17763.4645
Microsoft ≫ Windows 10 21h2 Version < 10.0.19041.3208
Microsoft ≫ Windows 10 22h2 Version < 10.0.19045.3208
Microsoft ≫ Windows 11 21h2 Version < 10.0.22000.2176
Microsoft ≫ Windows 11 22h2 Version < 10.0.22621.1992
Microsoft ≫ Windows Server 2008 Version- Updatesp2
Microsoft ≫ Windows Server 2008 Versionr2 Updatesp1 HwPlatformx64
Microsoft ≫ Windows Server 2016 Version < 10.0.14393.6085
Microsoft ≫ Windows Server 2019 Version < 10.0.17763.4645
Microsoft ≫ Windows Server 2022 Version < 10.0.20348.1850

11.07.2023: CISA Known Exploited Vulnerabilities (KEV) Catalog

Microsoft Windows Error Reporting Service Privilege Escalation Vulnerability

Vulnerability

Microsoft Windows Error Reporting Service contains an unspecified vulnerability that allows for privilege escalation.

Description

Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.

Required actions
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 61.74% 0.983
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
secure@microsoft.com 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-59 Improper Link Resolution Before File Access ('Link Following')

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.