Lucene search

MicrosoftCVE-2020-0870

HistorySep 11, 2020 - 5:15 p.m.

CVE-2020-0870

2020-09-1117:15:14

microsoft

web.nvd.nist.gov

cve

2020

0870

shell

infrastructure

elevation of privilege

vulnerability

nvd

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

Confidence

High

EPSS

Percentile

9.5%

JSON

An elevation of privilege vulnerability exists when the Shell infrastructure component improperly handles objects in memory. An attacker who successfully exploited this vulnerability could run processes in an elevated context.
To exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application that could exploit the vulnerability and take control of an affected system.
The update addresses the vulnerability by correcting the way in which the Shell infrastructure component handles objects in memory and preventing unintended elevation from lower integrity application.

Affected configurations

Nvd

Vulners

Node

microsoftwindows_10Match1607x64

microsoftwindows_10Match1607x86

microsoftwindows_10Match1709

microsoftwindows_10Match1803

microsoftwindows_10Match1809

microsoftwindows_10Match1903

microsoftwindows_10Match1909

microsoftwindows_server_2016Match-

microsoftwindows_server_2019Match-

VendorProductVersionCPE
microsoftwindows_101607cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:x64:*
microsoftwindows_101607cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:x86:*
microsoftwindows_101709cpe:2.3:o:microsoft:windows_10:1709:*:*:*:*:*:*:*
microsoftwindows_101803cpe:2.3:o:microsoft:windows_10:1803:*:*:*:*:*:*:*
microsoftwindows_101809cpe:2.3:o:microsoft:windows_10:1809:*:*:*:*:*:*:*
microsoftwindows_101903cpe:2.3:o:microsoft:windows_10:1903:*:*:*:*:*:*:*
microsoftwindows_101909cpe:2.3:o:microsoft:windows_10:1909:*:*:*:*:*:*:*
microsoftwindows_server_2016-cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*
microsoftwindows_server_2019-cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
microsoft	windows_10	1607	cpe:2.3:o:microsoft:windows_10:1607::::::x64:
microsoft	windows_10	1607	cpe:2.3:o:microsoft:windows_10:1607::::::x86:
microsoft	windows_10	1709	cpe:2.3:o:microsoft:windows_10:1709:::::::*
microsoft	windows_10	1803	cpe:2.3:o:microsoft:windows_10:1803:::::::*
microsoft	windows_10	1809	cpe:2.3:o:microsoft:windows_10:1809:::::::*
microsoft	windows_10	1903	cpe:2.3:o:microsoft:windows_10:1903:::::::*
microsoft	windows_10	1909	cpe:2.3:o:microsoft:windows_10:1909:::::::*
microsoft	windows_server_2016	-	cpe:2.3:o:microsoft:windows_server_2016:-:::::::*
microsoft	windows_server_2019	-	cpe:2.3:o:microsoft:windows_server_2019:-:::::::*

CNA Affected

[
  {
    "vendor": "Microsoft",
    "product": "Windows 10 Version 1803",
    "cpes": [
      "cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*",
      "cpe:2.3:o:microsoft:windows_10_1803:*:*:*:*:*:*:x64:*",
      "cpe:2.3:o:microsoft:windows_10_1803:*:*:*:*:*:*:arm64:*"
    ],
    "platforms": [
      "32-bit Systems",
      "x64-based Systems",
      "ARM64-based Systems"
    ],
    "versions": [
      {
        "version": "10.0.0",
        "lessThan": "publication",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Windows 10 Version 1809",
    "cpes": [
      "cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*",
      "cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*",
      "cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:arm64:*"
    ],
    "platforms": [
      "32-bit Systems",
      "x64-based Systems",
      "ARM64-based Systems"
    ],
    "versions": [
      {
        "version": "10.0.0",
        "lessThan": "publication",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Windows Server 2019",
    "cpes": [
      "cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*"
    ],
    "platforms": [
      "x64-based Systems"
    ],
    "versions": [
      {
        "version": "10.0.0",
        "lessThan": "publication",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Windows 10 Version 1909",
    "cpes": [
      "cpe:2.3:o:microsoft:windows_10_1909:*:*:*:*:*:*:x86:*",
      "cpe:2.3:o:microsoft:windows_10_1909:*:*:*:*:*:*:x64:*",
      "cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*"
    ],
    "platforms": [
      "32-bit Systems",
      "x64-based Systems",
      "ARM64-based Systems"
    ],
    "versions": [
      {
        "version": "10.0.0",
        "lessThan": "publication",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Windows 10 Version 1709 for 32-bit Systems",
    "cpes": [
      "cpe:2.3:o:microsoft:windows_10:1709:*:*:*:*:*:*:*"
    ],
    "platforms": [
      "32-bit Systems"
    ],
    "versions": [
      {
        "version": "10.0.0",
        "lessThan": "publication",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Windows 10 Version 1709",
    "cpes": [
      "cpe:2.3:o:microsoft:windows_10:1709:*:*:*:*:*:*:*"
    ],
    "platforms": [
      "x64-based Systems",
      "ARM64-based Systems"
    ],
    "versions": [
      {
        "version": "10.0.0",
        "lessThan": "publication",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Windows 10 Version 1903 for 32-bit Systems",
    "cpes": [
      "cpe:2.3:o:microsoft:windows_10:1903:*:*:*:*:*:*:*"
    ],
    "platforms": [
      "Unknown"
    ],
    "versions": [
      {
        "version": "10.0.0",
        "lessThan": "publication",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Windows 10 Version 1903 for x64-based Systems",
    "cpes": [
      "cpe:2.3:o:microsoft:windows_10:1903:*:*:*:*:*:*:*"
    ],
    "platforms": [
      "Unknown"
    ],
    "versions": [
      {
        "version": "10.0.0",
        "lessThan": "publication",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Windows 10 Version 1903 for ARM64-based Systems",
    "cpes": [
      "cpe:2.3:o:microsoft:windows_10:1903:*:*:*:*:*:*:*"
    ],
    "platforms": [
      "Unknown"
    ],
    "versions": [
      {
        "version": "10.0.0",
        "lessThan": "publication",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Windows 10 Version 1607",
    "cpes": [
      "cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*",
      "cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*"
    ],
    "platforms": [
      "32-bit Systems",
      "x64-based Systems"
    ],
    "versions": [
      {
        "version": "10.0.0",
        "lessThan": "publication",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Windows Server 2016",
    "cpes": [
      "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*"
    ],
    "platforms": [
      "x64-based Systems"
    ],
    "versions": [
      {
        "version": "10.0.0",
        "lessThan": "publication",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  }
]