CVE-2020-1122

Windows Language Pack Installer Elevation of Privilege Vulnerability

En bref

Sévérité: MEDIUM 5.5
EPSS: EPSS 0.96 % · centile 61 (2026-10-27)
État: PUBLISHED
Publiée: 2020-09-11
Mise à jour: 2024-08-04
Attribuée par: microsoft
Statut NVD: Modified

Description

An elevation of privilege vulnerability exists when the Windows Language Pack Installer improperly handles file operations. An attacker who successfully exploited this vulnerability could run processes in an elevated context. An attacker could exploit this vulnerability by running a specially crafted application on the victim system. The update addresses the vulnerability by correcting the way the Windows Language Pack Installer handles file operations.

Scores

Version	Score	Vecteur	Évalué par
CVSS 3.1	MEDIUM 5.5	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C	microsoft
CVSS 3.1	MEDIUM 5.5	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N	NVD · secure@microsoft.com (Secondary)
CVSS 3.1	HIGH 7.8	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	NVD · nvd@nist.gov (Secondary)
CVSS 2.0	MEDIUM 4.6	AV:L/AC:L/Au:N/C:P/I:P/A:P	NVD · nvd@nist.gov (Primary)

Faiblesses (CWE)

CWE-754

Références européennes

ENISA EUVD · EUVD-2020-12009
GCVE · GCVE-0-2020-1122

Avis du CERT-FR

CERTFR-2020-AVI-562 — Multiples vulnérabilités dans Microsoft Windows · cert.ssi.gouv.fr

Configurations affectées (CPE NVD)

cpe:2.3:o:microsoft:windows_10:1803:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_10:1809:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_10:1903:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_10:1909:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_10:2004:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2016:1903:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2016:1909:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2016:2004:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*

Produits affectés

Produit	Versions
Microsoft · Windows 10 Version 1803	affected 10.0.0 < publication
Microsoft · Windows 10 Version 1809	affected 10.0.0 < publication
Microsoft · Windows Server 2019	affected 10.0.0 < publication
Microsoft · Windows Server 2019 (Server Core installation)	affected 10.0.0 < publication
Microsoft · Windows 10 Version 1909	affected 10.0.0 < publication
Microsoft · Windows Server, version 1909 (Server Core installation)	affected 10.0.0 < publication
Microsoft · Windows 10 Version 1903 for 32-bit Systems	affected 10.0.0 < publication
Microsoft · Windows 10 Version 1903 for x64-based Systems	affected 10.0.0 < publication
Microsoft · Windows 10 Version 1903 for ARM64-based Systems	affected 10.0.0 < publication
Microsoft · Windows Server, version 1903 (Server Core installation)	affected 10.0.0 < publication
Microsoft · Windows 10 Version 2004	affected 10.0.0 < publication
Microsoft · Windows Server version 2004	affected 10.0.0 < publication

Références

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1122

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD