CVE-2019-1069
Task Scheduler Elevation of Privilege Vulnerability
At a glance
- Source
- NVD
- EPSS
- EPSS 6.12 % · percentile 93 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- microsoft
- NVD status
- Analyzed
Description
An elevation of privilege vulnerability exists in the way the Task Scheduler Service validates certain file operations. An attacker who successfully exploited the vulnerability could gain elevated privileges on a victim system. To exploit the vulnerability, an attacker would require unprivileged code execution on a victim system. The security update addresses the vulnerability by correctly validating file operations.
Weaknesses (CWE)
- CWE-59 — Improper Link Resolution Before File Access
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2019-1069
- https://www.kb.cert.org/vuls/id/119704
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1069
- https://blog.0patch.com/2019/06/another-task-scheduler-0day-another.html
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-1069
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C | microsoft |
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD · secure@microsoft.com (Secondary) |
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | HIGH 7.2 | AV:L/AC:L/Au:N/C:C/I:C/A:C | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2019-9651
- GCVE · GCVE-0-2019-1069
CERT-FR advisories
- CERTFR-2019-AVI-264 — Multiples vulnérabilités dans Microsoft Windows · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:*:*cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:*:*cpe:2.3:o:microsoft:windows_10_1703:-:*:*:*:*:*:*:*cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:*:*cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:*:*cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:*:*cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:*:*cpe:2.3:o:microsoft:windows_server_1803:-:*:*:*:*:*:*:*cpe:2.3:o:microsoft:windows_server_1903:-:*:*:*:*:*:*:*cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*
Affected products
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| CISA Known Exploited Vulnerabilities | CC0 1.0 |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |