CVE-2020-1337

Katalog CVE

CVSS 7.8 · High EPSS 14,1%

Kerentanan Time-of-check Time-of-use (TOCTOU) Race Condition pada microsoft windows 10, microsoft windows 7 +6 lainnya. Skor CVSS 3.1 7.8 (High) menurut microsoft.com.

Deskripsi (NVD)

An elevation of privilege vulnerability exists when the Windows Print Spooler service improperly allows arbitrary writing to the file system. An attacker who successfully exploited this vulnerability could run arbitrary code with elevated system privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. To exploit this vulnerability, an attacker would have to log on to an affected system and run a specially crafted script or application. The update addresses the vulnerability by correcting how the Windows Print Spooler Component writes to the file system.

Rincian

Terbit di NVD

17 Agustus 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.8 (High), sumber microsoft.com
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition

EPSS (30 hari)

14,1% peluang dieksploitasi; lebih tinggi dari 96,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1337 patch · advisory vendor
• http://packetstormsecurity.com/files/160028/Microsoft-Windows-Local-Spooler-Bypass.html exploit · advisory pihak ketiga · vdb entry
• http://packetstormsecurity.com/files/160993/Microsoft-Spooler-Local-Privilege-Elevation.html exploit · advisory pihak ketiga · vdb entry