CVE-2019-1342 — Link Following in Microsoft Windows

CWE-59 — Link FollowingCWE-755 — Improper Handling of Exceptional ConditionsCWE-20 — Improper Input Validation16 documents8 sources
Severity
7.8HIGHNVD
EPSS
0.5%
top 32.03%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
9
Microsoft WindowsMicrosoft Windows 10 Version 1903 FOR 32-bit SystemsMicrosoft Windows 10 Version 1903 FOR Arm64-based Systems+6 more
Timeline
PublishedOct 10
Latest updateMay 24

Description

An elevation of privilege vulnerability exists when Windows Error Reporting manager improperly handles a process crash, aka 'Windows Error Reporting Manager Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1315, CVE-2019-1339.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages7 packages

▶CVEListV5microsoft/windows20 versions+19
▶NVDmicrosoft/windowsr2, 1803, 1903+2
▶NVDmicrosoft/windows_106 versions+5
▶CVEListV5microsoft/windows_server17 versions+16

Patches

Patch: portal.msrc.microsoft.com ↗Patch: portal.msrc.microsoft.com ↗

🔴Vulnerability Details

6
GHSA
GHSA-jg5r-v4q8-v8jv: An elevation of privilege vulnerability exists when Windows Error Reporting manager improperly handles hard links, aka 'Windows Error Reporting Manage↗2022-05-24
▶
GHSA
GHSA-6v6c-5w6v-23mc: An elevation of privilege vulnerability exists when Windows Error Reporting manager improperly handles a process crash, aka 'Windows Error Reporting M↗2022-05-24
▶
GHSA
GHSA-mgx4-mfmv-7vwr: An elevation of privilege vulnerability exists when Windows Error Reporting manager improperly handles hard links, aka 'Windows Error Reporting Manage↗2022-05-24
▶
CVEList
CVE-2019-1339: An elevation of privilege vulnerability exists when Windows Error Reporting manager improperly handles hard links, aka 'Windows Error Reporting Manage↗2019-10-10
▶
CVEList
CVE-2019-1315: An elevation of privilege vulnerability exists when Windows Error Reporting manager improperly handles hard links, aka 'Windows Error Reporting Manage↗2019-10-10
▶

📋Vendor Advisories

2
Microsoft
Windows Error Reporting Manager Elevation of Privilege Vulnerability↗2019-10-08
▶
Red Hat
jenkins-job-dsl-plugin: Script security sandbox bypass in Job DSL Plugin (SECURITY-1342)↗2019-03-06
▶

🕵️Threat Intelligence

4
Unit42
Unit 42 Discovers 13 New Vulnerabilities Across Microsoft and Adobe Products↗2019-12-19
▶
Unit42
Unit 42 Discovers 13 New Vulnerabilities Across Microsoft and Adobe Products↗2019-12-19
▶
Talos
Microsoft Patch Tuesday — Oct. 2019: Vulnerability disclosures and Snort coverage↗2019-10-08
▶
Talos
Microsoft Patch Tuesday — Oct. 2019: Vulnerability disclosures and Snort coverage↗2019-10-08
▶

💬Community

1
Bugzilla
CVE-2019-1003034 jenkins-job-dsl-plugin: Script security sandbox bypass in Job DSL Plugin (SECURITY-1342)↗2019-03-20
▶
CVE-2019-1342 — Link Following in Microsoft Windows | cvebase