Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2019-0552

CWE-863 — Incorrect Authorization5 documents5 sources
Severity
8.8HIGH
EPSS
0.4%
top 37.06%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
8
Microsoft Windows 10Microsoft Windows 10 ServersMicrosoft Windows 8.1+5 more
Timeline
PublishedJan 8
Latest updateMay 13

Description

An elevation of privilege exists in Windows COM Desktop Broker, aka "Windows COM Elevation of Privilege Vulnerability." This affects Windows Server 2012 R2, Windows RT 8.1, Windows Server 2019, Windows Server 2016, Windows 8.1, Windows 10, Windows 10 Servers.

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HExploitability: 2.0 | Impact: 6.0

Affected Packages9 packages

▶CVEListV5microsoft/windows_10_serversversion 1709 (Server Core Installation), version 1803 (Server Core Installation)+1
▶CVEListV5microsoft/windows_server_2016(Server Core installation)
▶CVEListV5microsoft/windows_server_2019(Server Core installation)
▶CVEListV5microsoft/windows_server_2012_r2(Server Core installation)
▶NVDmicrosoft/windowsr2, 1709, 1803+2

Patches

Patch: portal.msrc.microsoft.com ↗Patch: portal.msrc.microsoft.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-vxxj-78qm-2x3m: An elevation of privilege exists in Windows COM Desktop Broker, aka "Windows COM Elevation of Privilege Vulnerability↗2022-05-13
▶
CVEList
CVE-2019-0552: An elevation of privilege exists in Windows COM Desktop Broker, aka "Windows COM Elevation of Privilege Vulnerability↗2019-01-08
▶

💥Exploits & PoCs

1
Exploit-DB
Microsoft Windows 10 - COM Desktop Broker Privilege Escalation↗2019-01-14
▶

📋Vendor Advisories

1
Microsoft
Windows COM Elevation of Privilege Vulnerability↗2019-01-08
▶
CVE-2019-0552 (HIGH CVSS 8.8) | An elevation of privilege exists in | cvebase.io