Microsoft Windows
En bref
- Source
- NVD
- EPSS
- EPSS 19.25 % · centile 97 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- microsoft
- Statut NVD
- Analyzed
Rechercher sur…
Description
An elevation of privilege vulnerability exists in the way that ws2ifsl.sys (Winsock) handles objects in memory, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1253, CVE-2019-1278, CVE-2019-1303.
Faiblesses (CWE)
- CWE-269 — Gestion incorrecte des privilèges
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | CISA-ADP |
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary) |
| CVSS 2.0 | HIGH 7.2 | AV:L/AC:L/Au:N/C:C/I:C/A:C | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2019-9783
- GCVE · GCVE-0-2019-1215
Avis du CERT-FR
- CERTFR-2019-AVI-568 — Multiples vulnérabilités dans Microsoft Windows · cert.ssi.gouv.fr
- CERTFR-2019-AVI-436 — Multiples vulnérabilités dans Microsoft Windows · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:x64:*cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:x86:*cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x64:*cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x86:*cpe:2.3:o:microsoft:windows_10_1703:-:*:*:*:*:*:x64:*cpe:2.3:o:microsoft:windows_10_1703:-:*:*:*:*:*:x86:*cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:arm64:*cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:x64:*cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:x86:*cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:arm64:*cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:x64:*cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:x86:*cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:arm64:*cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x64:*cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x86:*cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:arm64:*cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:x64:*cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:x86:*cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*cpe:2.3:o:microsoft:windows_server_1803:-:*:*:*:*:*:x64:*cpe:2.3:o:microsoft:windows_server_1903:-:*:*:*:*:*:x64:*cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:itanium:*cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| Microsoft · Windows | affected 7 for 32-bit Systems Service Pack 1 ; affected 7 for x64-based Systems Service Pack 1 ; affected 8.1 for 32-bit systems ; affected 8.1 for x64-based systems ; affected RT 8.1 ; affected 10 for 32-bit Systems |
| Microsoft · Windows Server | affected 2008 R2 for x64-based Systems Service Pack 1 (Core installation) ; affected 2008 R2 for Itanium-Based Systems Service Pack 1 ; affected 2008 R2 for x64-based Systems Service Pack 1 ; affected 2008 for 32-bit Systems Service Pack 2 (Core installation) ; affected 2012 ; affected 2012 (Core installation) |
| Microsoft · Windows 10 Version 1903 for 32-bit Systems | affected unspecified |
| Microsoft · Windows 10 Version 1903 for x64-based Systems | affected unspecified |
| Microsoft · Windows 10 Version 1903 for ARM64-based Systems | affected unspecified |
| Microsoft · Windows Server, version 1903 (Server Core installation) | affected unspecified |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| CISA Known Exploited Vulnerabilities | CC0 1.0 |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |