CVE-2019-1130KEV · OVERDUECWE-59

Microsoft Windows AppX Deployment Service Privilege Escalation Vulnerability

High · published July 15, 2019

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 7.8. It is confirmed in active exploitation. It sits in the 77.3th percentile for exploit probability.

1593
days past CISA
deadline
CVSS v3.1
7.8
EPSS
2%
Percentile
77.3
In the wild
Confirmed
What it is

🚨 A crafty handling of hard links is all it takes for an attacker to elevate their privileges on your Windows system! ⚡ Think of it like a hotel that gives out master keys without verifying the guest's identity—suddenly, anyone can access any room! Just as that could lead to chaos, this vulnerability allows unauthorized access to sensitive areas of the operating system. An attacker could exploit this vulnerability to gain elevated privileges, allowing them to install malicious software, access sensitive data, or even take control of the entire system. This could lead to absolute mayhem, with potential data breaches and system compromises lurking around every corner!

Put simply

Think of it like a hotel that gives out master keys without verifying the guest's identity—suddenly, anyone can access any room! Just as that could lead to chaos, this vulnerability allows unauthorized access to sensitive areas of the operating system. This elevation of privilege vulnerability is due to the Windows AppX Deployment Service (AppXSVC) mishandling hard links, allowing attackers to gain higher access levels than intended, bypassing security controls.

What to do

An attacker could exploit this vulnerability to gain elevated privileges, allowing them to install malicious software, access sensitive data, or even take control of the entire system. This could lead to absolute mayhem, with potential data breaches and system compromises lurking around every corner! Immediately apply the security update that addresses this vulnerability. If you're unable to patch right away, consider restricting access to the AppX Deployment Service as a temporary measure to minimize risk until the update can be implemented. Be sure to audit your systems for signs of exploitation! You can tackle this vulnerability head-on! Patch your systems promptly, and you'll be back on track in no time! 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01719 · 77.3th percentile
Weakness
CWE-59 · Improper Link Resolution Before File Access ('Link Following')
Published
2019-07-15T23:15Z
KEV added
2022-05-23 · due 2022-06-13
Affected products (26)
ProductVersionsFixed in
microsoft/windows_10_1507all versions—
microsoft/windows_10_1507all versions—
microsoft/windows_10_1607all versions—
microsoft/windows_10_1607all versions—
microsoft/windows_10_1703all versions—
microsoft/windows_10_1703all versions—
microsoft/windows_10_1709all versions—
microsoft/windows_10_1709all versions—
microsoft/windows_10_1709all versions—
microsoft/windows_10_1803all versions—
microsoft/windows_10_1803all versions—
microsoft/windows_10_1803all versions—
microsoft/windows_10_1809all versions—
microsoft/windows_10_1809all versions—
microsoft/windows_10_1809all versions—
microsoft/windows_10_1903all versions—
microsoft/windows_10_1903all versions—
microsoft/windows_10_1903all versions—
microsoft/windows_8.1all versions—
microsoft/windows_rt_8.1all versions—
microsoft/windows_server_1803all versions—
microsoft/windows_server_1903all versions—
microsoft/windows_server_2012all versions—
microsoft/windows_server_2012all versions—
microsoft/windows_server_2016all versions—
microsoft/windows_server_2019all versions—
References (3)
EPSS history
Timeline
  • 23 MAY 00:00Z
    Added to CISA KEV — remediate by Jun 13
    kev
  • 29 JUL 14:13Z
    An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows Elevation of…
    cvelistv5