CVE-2020-1537
published 2020-08-17CVE-2020-1537: An elevation of privilege vulnerability exists when the Windows Remote Access improperly handles file operations. An attacker who successfully exploited this…
PriorityP338high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.80%
52.3th percentile
An elevation of privilege vulnerability exists when the Windows Remote Access improperly handles file operations. An attacker who successfully exploited this vulnerability could gain elevated privileges.
To exploit the vulnerability, an attacker would first need code execution on a victim system. An attacker could then run a specially crafted application.
The security update addresses the vulnerability by ensuring the Windows Remote Access properly handles file operations.
Affected
53 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| gruntjs | grunt | >= 0 < 1.0.1-8ubuntu0.1+esm1 | 1.0.1-8ubuntu0.1+esm1 |
| gruntjs | grunt | >= 0 < 1.0.4-2ubuntu0.1~esm1 | 1.0.4-2ubuntu0.1~esm1 |
| gruntjs | grunt | >= 0 < 1.4.1-2ubuntu0.1~esm1 | 1.4.1-2ubuntu0.1~esm1 |
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10_version_1507 | >= 10.0.0 < publication | publication |
| microsoft | windows_10_version_1607 | >= 10.0.0 < publication | publication |
| microsoft | windows_10_version_1709 | >= 10.0.0 < publication | publication |
| microsoft | windows_10_version_1709_for_32-bit_systems | >= 10.0.0 < publication | publication |
| microsoft | windows_10_version_1803 | >= 10.0.0 < publication | publication |
| microsoft | windows_10_version_1809 | >= 10.0.0 < publication | publication |
| microsoft | windows_10_version_1903_for_32-bit_systems | >= 10.0.0 < publication | publication |
| microsoft | windows_10_version_1903_for_arm64-based_systems | >= 10.0.0 < publication | publication |
| microsoft | windows_10_version_1903_for_x64-based_systems | >= 10.0.0 < publication | publication |
| microsoft | windows_10_version_1909 | >= 10.0.0 < publication | publication |
| microsoft | windows_10_version_2004 | >= 10.0.0 < publication | publication |
| microsoft | windows_7 | >= 6.1.0 < publication | publication |
| microsoft | windows_7_service_pack_1 | >= 6.1.0 < publication | publication |
| microsoft | windows_8.1 | >= 6.3.0 < publication | publication |
| microsoft | windows_server_2008_r2_service_pack_1 | >= 6.0.0 < publication | publication |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.04.6MEDIUMAV:L/AC:L/Au:N/C:P/I:P/A:P
osv7.1HIGH
vendor_msrc7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Microsoft
Windows Remote Access Elevation of Privilege Vulnerability
vendor_msrc·2020-08-11·CVSS 7.8
CVE-2020-1537 [HIGH] Windows Remote Access Elevation of Privilege Vulnerability
Windows Remote Access Elevation of Privilege Vulnerability
Description: An elevation of privilege vulnerability exists when the Windows Remote Access improperly handles file operations. An attacker who successfully exploited this vulnerability could gain elevated privileges.
To exploit the vulnerability, an attacker would first need code execution on a victim system. An attacker could then run a specially crafted application.
The security update addresses the vulnerability by ensuring the Windows Remote Access properly handles file operations.
FAQ: I am running Windows 8.1 or Windows Server 2012 R2. Are the updates for these operating systems currently available?
On August 19, 2020, Microsoft released security update 4578013 for all supported versions of Microsoft 8.1 and Windows Server
OSV
grunt vulnerabilities
osv·2023-02-07·CVSS 7.1
CVE-2020-7729 grunt vulnerabilities
grunt vulnerabilities
It was discovered that Grunt was not properly loading YAML files before
parsing them. An attacker could possibly use this issue to execute
arbitrary code. (CVE-2020-7729)
It was discovered that Grunt was not properly handling symbolic links
when performing file copy operations. An attacker could possibly use this
issue to expose sensitive information or execute arbitrary code.
(CVE-2022-0436)
It was discovered that there was a race condition in the Grunt file copy
function, which could lead to an arbitrary file write. An attacker could
possibly use this issue to perform a local privilege escalation attack or
to execute arbitrary code. (CVE-2022-1537)
GHSA
GHSA-g7cf-4hgh-v7qf: An elevation of privilege vulnerability exists when the Windows Remote Access improperly handles file operations, aka 'Windows Remote Access Elevation
ghsa_unreviewed·2022-05-24·CVSS 7.8
CVE-2020-1537 [HIGH] CWE-119 GHSA-g7cf-4hgh-v7qf: An elevation of privilege vulnerability exists when the Windows Remote Access improperly handles file operations, aka 'Windows Remote Access Elevation
An elevation of privilege vulnerability exists when the Windows Remote Access improperly handles file operations, aka 'Windows Remote Access Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-1530.
GHSA
GHSA-hf48-cw5q-wjpm: An elevation of privilege vulnerability exists when Windows Remote Access improperly handles memory
ghsa_unreviewed·2022-05-24·CVSS 7.8
CVE-2020-1530 [HIGH] CWE-119 GHSA-hf48-cw5q-wjpm: An elevation of privilege vulnerability exists when Windows Remote Access improperly handles memory
An elevation of privilege vulnerability exists when Windows Remote Access improperly handles memory.To exploit this vulnerability, an attacker would first have to gain execution on the victim system, aka 'Windows Remote Access Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-1537.
No detection rules found.
No public exploits indexed.
2020-08-17
Published