⚠ Actively exploited in ransomware campaigns
This vulnerability is on the CISA Known Exploited Vulnerabilities list and has been used in known ransomware attacks. CISA required action: Apply updates per vendor instructions.. Due date: 2022-06-13.

CVE-2020-0638Link Following in Microsoft Windows

Severity
7.8HIGHNVD
EPSS
1.5%
top 18.98%
CISA KEV
KEVRansomware
Added 2022-05-23
Due 2022-06-13
Exploit
Exploited in wild
Active exploitation observed
Timeline
PublishedJan 14
KEV addedMay 23
Latest updateMay 24
KEV dueJun 13
CISA Required Action: Apply updates per vendor instructions.

Description

An elevation of privilege vulnerability exists in the way the Update Notification Manager handles files.To exploit this vulnerability, an attacker would first have to gain execution on the victim system, aka 'Update Notification Manager Elevation of Privilege Vulnerability'.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Patches

🔴Vulnerability Details

3
GHSA
GHSA-53p9-m4mr-wp8x: An elevation of privilege vulnerability exists in the way the Update Notification Manager handles files2022-05-24
CVEList
CVE-2020-0638: An elevation of privilege vulnerability exists in the way the Update Notification Manager handles files2020-01-14
VulnCheck
Microsoft Update Notification Manager Privilege Escalation Vulnerability2020

📋Vendor Advisories

2
CISA
Microsoft Update Notification Manager Privilege Escalation Vulnerability2022-05-23
Microsoft
Update Notification Manager Elevation of Privilege Vulnerability2020-01-14

🕵️Threat Intelligence

3
Tenable
ContiLeaks: Chats Reveal Over 30 Vulnerabilities Used by Conti Ransomware – How Tenable Can Help2022-03-24
Talos
Microsoft Patch Tuesday — Jan. 2020: Vulnerability disclosures and Snort coverage2020-01-14
Talos
Microsoft Patch Tuesday — Jan. 2020: Vulnerability disclosures and Snort coverage2020-01-14
CVE-2020-0638 — Link Following in Microsoft Windows | cvebase