CVE-2020-0787KEV Β· OVERDUECWE-59

Microsoft Windows Background Intelligent Transfer Service (BITS) Improper Privilege Management Vulnerability

High Β· published March 12, 2020

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 7.8. It is confirmed in active exploitation. It sits in the 98.7th percentile for exploit probability.

1548
days past CISA
deadline
CVSS v3.1
7.8
EPSS
43%
Percentile
98.7
In the wild
Confirmed
What it is

🚨 A crafty user could exploit this flaw to elevate their privileges on a Windows system, all thanks to the Background Intelligent Transfer Service's (BITS) mishandling of symbolic links! ⚑ Think of BITS like a hotel concierge who gets a bit too trusting and hands out keys to any random guest without checking their identification β€” you might just end up giving someone access to your suite! An attacker could gain elevated permissions, allowing them to install malicious software, access sensitive data, or even take full control of the system. It's a serious security breach that could lead to devastating consequences for your system and data integrity!

Put simply

Think of BITS like a hotel concierge who gets a bit too trusting and hands out keys to any random guest without checking their identification β€” you might just end up giving someone access to your suite! This elevation of privilege vulnerability in BITS allows attackers to manipulate symbolic links, tricking the service into granting them higher access levels than intended, effectively bypassing security mechanisms.

What to do

An attacker could gain elevated permissions, allowing them to install malicious software, access sensitive data, or even take full control of the system. It's a serious security breach that could lead to devastating consequences for your system and data integrity! To protect your systems, ensure you apply the latest security updates provided by Microsoft. Disable BITS if it's not required for your environment, and consider enabling strict access controls for symbolic links. Regularly audit permissions to keep your systems secure. You've got this! Follow these steps, and you'll reinforce your defenses in no time! πŸ›‘οΈ

The record
Technical detail
CVSS v3.1
7.8 Β· HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.42524 Β· 98.7th percentile
Weakness
CWE-59 Β· Improper Link Resolution Before File Access ('Link Following')
Published
2020-03-12T20:15Z
KEV added
2022-01-28 Β· due 2022-07-28
Affected products (19)
ProductVersionsFixed in
microsoft/windows_10_1507all versionsβ€”
microsoft/windows_10_1607all versionsβ€”
microsoft/windows_10_1709all versionsβ€”
microsoft/windows_10_1803all versionsβ€”
microsoft/windows_10_1809all versionsβ€”
microsoft/windows_10_1903all versionsβ€”
microsoft/windows_10_1909all versionsβ€”
microsoft/windows_7all versionsβ€”
microsoft/windows_8.1all versionsβ€”
microsoft/windows_rt_8.1all versionsβ€”
microsoft/windows_server_1803all versionsβ€”
microsoft/windows_server_1903all versionsβ€”
microsoft/windows_server_1909all versionsβ€”
microsoft/windows_server_2008all versionsβ€”
microsoft/windows_server_2008all versionsβ€”
microsoft/windows_server_2012all versionsβ€”
microsoft/windows_server_2012all versionsβ€”
microsoft/windows_server_2016all versionsβ€”
microsoft/windows_server_2019all versionsβ€”
References (5)
EPSS history
Timeline
  • 28 JAN 00:00Z
    Added to CISA KEV β€” remediate by Jul 28
    kev
  • 12 MAR 15:48Z
    An elevation of privilege vulnerability exists when the Windows Background Intelligent Transfer Service (BITS) improperly handles symbolic links, aka 'Windows…
    cvelistv5