CVE-2020-1048

Katalog CVE

CVSS 7.8 · High EPSS 16,4%

Kerentanan Incorrect Resource Transfer Between Spheres pada microsoft windows 10, microsoft windows 7 +6 lainnya. Skor CVSS 3.1 7.8 (High) menurut microsoft.com.

Deskripsi (NVD)

An elevation of privilege vulnerability exists when the Windows Print Spooler service improperly allows arbitrary writing to the file system. An attacker who successfully exploited this vulnerability could run arbitrary code with elevated system privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. To exploit this vulnerability, an attacker would have to log on to an affected system and run a specially crafted script or application. The update addresses the vulnerability by correcting how the Windows Print Spooler Component writes to the file system.

Rincian

Terbit di NVD

21 Mei 2020

Terakhir diubah

19 Agustus 2026

Status NVD

Modified

CVSS 3.1

7.8 (High), sumber microsoft.com
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-669: Incorrect Resource Transfer Between Spheres

EPSS (30 hari)

16,4% peluang dieksploitasi; lebih tinggi dari 96,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1048 patch · advisory vendor
• http://packetstormsecurity.com/files/158222/Windows-Print-Spooler-Privilege-Escalation.html advisory pihak ketiga · vdb entry
• http://packetstormsecurity.com/files/159217/Microsoft-Spooler-Local-Privilege-Elevation.html exploit · advisory pihak ketiga · vdb entry
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2020-1048