Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2019-0555 — Missing Authorization in Microsoft Windows 10

CWE-862 — Missing Authorization5 documents5 sources
Severity
7.8HIGHNVD
EPSS
1.5%
top 19.01%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
17
Microsoft Windows 10Microsoft Windows Server 2012Microsoft Windows Server 2016+14 more
Timeline
PublishedJan 8
Latest updateJan 1

Description

An elevation of privilege vulnerability exists in the Microsoft XmlDocument class that could allow an attacker to escape from the AppContainer sandbox in the browser, aka "Microsoft XmlDocument Elevation of Privilege Vulnerability." This affects Windows Server 2012 R2, Windows RT 8.1, Windows Server 2012, Windows Server 2019, Windows Server 2016, Windows 8.1, Windows 10, Windows 10 Servers.

CVSS vector

CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:HExploitability: 1.1 | Impact: 6.0

Affected Packages16 packages

Patches

Patch: portal.msrc.microsoft.com ↗Patch: portal.msrc.microsoft.com ↗

🔴Vulnerability Details

2
Project0
Windows Bug Class: Accessing Trapped COM Objects with IDispatch - Project Zero↗2025-01-01
▶
GHSA
GHSA-x49p-2wmh-gxv5: An elevation of privilege vulnerability exists in the Microsoft XmlDocument class that could allow an attacker to escape from the AppContainer sandbox↗2022-05-13
▶

💥Exploits & PoCs

1
Exploit-DB
Microsoft Windows 10 - XmlDocument Insecure Sharing Privilege Escalation↗2019-01-16
▶

📋Vendor Advisories

1
Microsoft
Microsoft XmlDocument Elevation of Privilege Vulnerability↗2019-01-08
▶
CVE-2019-0555 — Missing Authorization in Microsoft | cvebase