⚠ Actively exploited in ransomware campaigns
This vulnerability is on the CISA Known Exploited Vulnerabilities list and has been used in known ransomware attacks. CISA required action: Apply updates per vendor instructions.. Due date: 2022-04-05.

CVE-2019-1129 — Link Following in Microsoft Windows

CWE-59 — Link Following10 documents8 sources
Severity
7.8HIGHNVD
EPSS
2.1%
top 16.04%
CISA KEV
KEVRansomware
Added 2022-03-15
Due 2022-04-05
Exploit
Exploited in wild
Active exploitation observed
Affected products
23
Microsoft WindowsMicrosoft Windows 10 Version 1903 FOR 32-bit SystemsMicrosoft Windows 10 Version 1903 FOR Arm64-based Systems+20 more
Timeline
PublishedJul 15
KEV addedMar 15
KEV dueApr 5
Latest updateMay 24
CISA Required Action: Apply updates per vendor instructions.

Description

An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1130.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages23 packages

▶CVEListV5microsoft/windows17 versions+16
▶CVEListV5microsoft/windows_server9 versions+8

Patches

Patch: portal.msrc.microsoft.com ↗Patch: portal.msrc.microsoft.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-gxfx-4m5q-qcqf: An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows Elevation of↗2022-05-24
▶
GHSA
GHSA-jcpw-f7c4-6wr7: An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows Elevation of↗2022-05-24
▶
VulnCheck
Microsoft Windows AppX Deployment Service (AppXSVC) Privilege Escalation Vulnerability↗2019
▶

📋Vendor Advisories

2
CISA
Microsoft Windows AppX Deployment Service (AppXSVC) Privilege Escalation Vulnerability↗2022-03-15
▶
Microsoft
Windows Elevation of Privilege Vulnerability↗2019-07-09
▶

🕵️Threat Intelligence

2
Tenable
ContiLeaks: Chats Reveal Over 30 Vulnerabilities Used by Conti Ransomware – How Tenable Can Help↗2022-03-24
▶
Zscaler
Zscaler found Multiple Security Vulnerabilities | 07-10-2019↗
▶

💬Community

1
Bugzilla
CVE-2019-11459 evince: uninitialized memory use in function tiff_document_render() and tiff_document_get_thumbnail()↗2019-06-03
▶
CVE-2019-1129 — Link Following in Microsoft Windows | cvebase