CVE-2019-1385KEV · OVERDUECWE-59

Microsoft Windows AppX Deployment Extensions Privilege Escalation Vulnerability

High · published November 13, 2019

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 7.8. It is confirmed in active exploitation. It sits in the 89.4th percentile for exploit probability.

1593
days past CISA
deadline
CVSS v3.1
7.8
EPSS
4%
Percentile
89.4
In the wild
Confirmed
What it is

⚡ A crafty app can elevate its privileges to access system files without proper authorization! This vulnerability in the Windows AppX Deployment Extensions is absolutely devastating! Think of it like a guest at a hotel who finds a way to sneak into the manager's office and access sensitive files like room keys or payment info. This flaw lets an attacker, who's already authenticated, elevate their access and roam around in areas they shouldn't! If exploited, an attacker could potentially take control of sensitive system files, modify configurations, or even install malicious software with elevated privileges. It's like giving someone a master key to the whole building! Immediate attention is needed to prevent a worst-case scenario.

Put simply

Think of it like a guest at a hotel who finds a way to sneak into the manager's office and access sensitive files like room keys or payment info. This flaw lets an attacker, who's already authenticated, elevate their access and roam around in areas they shouldn't! This elevation of privilege vulnerability occurs due to improper privilege management in the Windows AppX Deployment Extensions, allowing authenticated attackers to run specially crafted applications to gain elevated access.

What to do

If exploited, an attacker could potentially take control of sensitive system files, modify configurations, or even install malicious software with elevated privileges. It's like giving someone a master key to the whole building! Immediate attention is needed to prevent a worst-case scenario. Patch your systems immediately with the latest security update that corrects the privilege management issues in AppX Deployment Extensions. Regularly audit installed applications to ensure no malicious files are lurking around! You've got this! With these steps, you can lock down your systems and protect your valuable data! 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.03604 · 89.4th percentile
Weakness
CWE-59 · Improper Link Resolution Before File Access ('Link Following')
Published
2019-11-13T00:15Z
KEV added
2022-05-23 · due 2022-06-13
Affected products (6)
ProductVersionsFixed in
microsoft/windows_10_1709all versions—
microsoft/windows_10_1803all versions—
microsoft/windows_10_1809all versions—
microsoft/windows_10_1903all versions—
microsoft/windows_server_2016all versions—
microsoft/windows_server_2019all versions—
References (5)
EPSS history
Timeline
  • 23 MAY 00:00Z
    Added to CISA KEV — remediate by Jun 13
    kev
  • 12 NOV 18:52Z
    An elevation of privilege vulnerability exists when the Windows AppX Deployment Extensions improperly performs privilege management, resulting in access to…
    cvelistv5