Vigie VulnDBEuropean-hosted Vulnerability DB

CVE-2020-1532

Windows InstallService Elevation of Privilege Vulnerability

En bref

Sévérité
HIGH 7.8
EPSS
EPSS 0.93 % · centile 60 (2026-10-27)
État
PUBLISHED
Publiée
Mise à jour
Attribuée par
microsoft
Statut NVD
Modified

Description

<p>An elevation of privilege vulnerability exists when the Windows InstallService improperly handles memory.</p> <p>To exploit this vulnerability, an attacker would first have to gain execution on the victim system. An attacker could then run a specially crafted application to elevate privileges.</p> <p>The security update addresses the vulnerability by correcting how the Windows InstallService handles memory.</p>

Scores

VersionScoreVecteurÉvalué par
CVSS 3.1HIGH 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:Cmicrosoft
CVSS 3.1HIGH 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HNVD · secure@microsoft.com (Secondary)
CVSS 3.1HIGH 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HNVD · nvd@nist.gov (Secondary)
CVSS 2.0MEDIUM 4.6AV:L/AC:L/Au:N/C:P/I:P/A:PNVD · nvd@nist.gov (Primary)

Références européennes

Avis du CERT-FR

Configurations affectées (CPE NVD)

Produits affectés

ProduitVersions
Microsoft · Windows 10 Version 1909affected 10.0.0 < publication
Microsoft · Windows Server, version 1909 (Server Core installation)affected 10.0.0 < publication
Microsoft · Windows 10 Version 1903 for 32-bit Systemsaffected 10.0.0 < publication
Microsoft · Windows 10 Version 1903 for x64-based Systemsaffected 10.0.0 < publication
Microsoft · Windows 10 Version 1903 for ARM64-based Systemsaffected 10.0.0 < publication
Microsoft · Windows Server, version 1903 (Server Core installation)affected 10.0.0 < publication
Microsoft · Windows 10 Version 2004affected 10.0.0 < publication
Microsoft · Windows Server version 2004affected 10.0.0 < publication

Références

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD