Vulnerability · Published May 21, 2020 · Assigned by microsoft
CVE-2020-1066.NET Framework Elevation of Privilege Vulnerability
High 7.8
In plain English
A high-severity security flaw in Microsoft .NET Framework 3.0 Service Pack 2 from Microsoft. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.5% (higher than 85% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
An elevation of privilege vulnerability exists in .NET Framework which could allow an attacker to elevate their privilege level. To exploit the vulnerability, an attacker would first have to access the local machine, and then run a malicious program. The update addresses the vulnerability by correcting how .NET Framework activates COM objects.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Microsoft | Microsoft .NET Framework 3.0 Service Pack 2 | 3.0.0 – before publication |
| Microsoft | Microsoft .NET Framework 3.5.1 | 3.5.0 – before publication |
References
- .NET Framework Elevation of Privilege Vulnerability vendor-advisory, patch
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1066 x_refsource_MISC, x_transferred