CVE-2020-1286 — Improper Input Validation in Microsoft Windows

CWE-20 — Improper Input ValidationCWE-1286 — Improper Validation of Syntactic Correctness of Input5 documents5 sources
Severity
8.8HIGHNVD
EPSS
35.3%
top 2.95%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
13
Microsoft WindowsMicrosoft Windows 10 Version 1903 FOR 32-bit SystemsMicrosoft Windows 10 Version 1903 FOR Arm64-based Systems+10 more
Timeline
PublishedJun 9
Latest updateMay 24

Description

A remote code execution vulnerability exists when the Windows Shell does not properly validate file paths.An attacker who successfully exploited this vulnerability could run arbitrary code in the context of the current user, aka 'Windows Shell Remote Code Execution Vulnerability'.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages13 packages

▶CVEListV5microsoft/windows9 versions+8
▶NVDmicrosoft/windows4 versions+3
▶NVDmicrosoft/windows_105 versions+4
▶CVEListV5microsoft/windows_server2019, 2019 (Core installation), version 1803 (Core Installation)+2

Patches

Patch: portal.msrc.microsoft.com ↗Patch: portal.msrc.microsoft.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-57wr-v5x3-8qhf: A remote code execution vulnerability exists when the Windows Shell does not properly validate file paths↗2022-05-24
▶
CVEList
CVE-2020-1286: A remote code execution vulnerability exists when the Windows Shell does not properly validate file paths↗2020-06-09
▶

📋Vendor Advisories

2
Red Hat
nodejs-url-parse: mishandling certain uses of backslash may lead to confidentiality compromise↗2021-02-22
▶
Microsoft
Windows Shell Remote Code Execution Vulnerability↗2020-06-09
▶
CVE-2020-1286 — Improper Input Validation in Microsoft | cvebase