CVE-2019-1336 — Improper Input Validation in Microsoft Windows

CWE-20 — Improper Input Validation12 documents7 sources
Severity
7.8HIGHNVD
EPSS
0.3%
top 49.16%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
7
Microsoft WindowsMicrosoft Windows 10 Version 1903 FOR 32-bit SystemsMicrosoft Windows 10 Version 1903 FOR Arm64-based Systems+4 more
Timeline
PublishedOct 10
Latest updateMay 24

Description

An elevation of privilege vulnerability exists in the Microsoft Windows Update Client when it does not properly handle privileges, aka 'Microsoft Windows Update Client Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1323.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages7 packages

▶CVEListV5microsoft/windows10 Version 1809 for 32-bit Systems, 10 Version 1809 for ARM64-based Systems, 10 Version 1809 for x64-based Systems+2
▶NVDmicrosoft/windows_101809, 1903+1
▶CVEListV5microsoft/windows_server2019, 2019 (Core installation)+1

Patches

Patch: portal.msrc.microsoft.com ↗Patch: portal.msrc.microsoft.com ↗

🔴Vulnerability Details

4
GHSA
GHSA-4c54-6q67-jfxv: An elevation of privilege vulnerability exists in the Microsoft Windows Update Client when it does not properly handle privileges, aka 'Microsoft Wind↗2022-05-24
▶
GHSA
GHSA-c2x3-jp7c-5whv: An elevation of privilege vulnerability exists in the Microsoft Windows Update Client when it does not properly handle privileges, aka 'Microsoft Wind↗2022-05-24
▶
CVEList
CVE-2019-1323: An elevation of privilege vulnerability exists in the Microsoft Windows Update Client when it does not properly handle privileges, aka 'Microsoft Wind↗2019-10-10
▶
CVEList
CVE-2019-1336: An elevation of privilege vulnerability exists in the Microsoft Windows Update Client when it does not properly handle privileges, aka 'Microsoft Wind↗2019-10-10
▶

📋Vendor Advisories

2
Microsoft
Microsoft Windows Update Client Elevation of Privilege Vulnerability↗2019-10-08
▶
Red Hat
jenkins-plugin-workflow-cps: Sandbox bypass in Pipeline: Groovy Plugin (SECURITY-1336(2))↗2019-03-06
▶

🕵️Threat Intelligence

2
Talos
Microsoft Patch Tuesday — Oct. 2019: Vulnerability disclosures and Snort coverage↗2019-10-08
▶
Talos
Microsoft Patch Tuesday — Oct. 2019: Vulnerability disclosures and Snort coverage↗2019-10-08
▶

💬Community

2
Bugzilla
CVE-2019-1003030 jenkins-plugin-workflow-cps: Sandbox bypass in Pipeline: Groovy Plugin (SECURITY-1336(2))↗2019-03-20
▶
Bugzilla
CVE-2019-1003029 jenkins-plugin-script-security: sandbox bypass in script security plugin↗2019-03-18
▶
CVE-2019-1336 — Improper Input Validation in Microsoft | cvebase