Actively exploited · Published Jun 12, 2019 · Assigned by microsoft
CVE-2019-1069Task Scheduler Elevation of Privilege Vulnerability
High 7.8 Exploited Ransomware
In plain English
A high-severity security flaw in Windows 10 Version 1507 from Microsoft. Attackers are actively exploiting it in the wild (listed by CISA on March 15, 2022). It has been used in ransomware campaigns. The chance it is exploited in the next 30 days is estimated at 6.2% (higher than 94% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Apply updates per vendor instructions.
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by Apr 5, 2022.
Official description
An elevation of privilege vulnerability exists in the way the Task Scheduler Service validates certain file operations. An attacker who successfully exploited the vulnerability could gain elevated privileges on a victim system. To exploit the vulnerability, an attacker would require unprivileged code execution on a victim system. The security update addresses the vulnerability by correctly validating file operations.
Affected products (as reported)
Weakness: CWE-59 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
References
- Task Scheduler Elevation of Privilege Vulnerability vendor-advisory
- VU#119704 third-party-advisory, x_refsource_CERT-VN, x_transferred
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1069 x_refsource_MISC, x_transferred
- https://blog.0patch.com/2019/06/another-task-scheduler-0day-another.html x_refsource_MISC, x_transferred
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-1069 government-resource