CVE-2019-1069: Microsoft Task Scheduler Privilege Escalation Vulnerability

Vulnerability summary

CVE-2019-1069 is a high (CVSS 7.8) Link Following vulnerability in Microsoft Task Scheduler. It is known to be exploited: CISA lists it, first on 15-03-2022. It has been used in ransomware campaigns. EPSS estimates a 6.12% chance of exploitation in the next 30 days, higher than 93.3% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 12-06-2019
   PublishedVulnerability first disclosed.
2. 15-03-2022
   Added to CISA KEVMicrosoft Task Scheduler Privilege Escalation Vulnerability
3. 05-04-2022
   CISA remediation dueApply updates per vendor instructions.
4. 12-08-2026
   Last modifiedVulnerability information updated.

Description

An elevation of privilege vulnerability exists in the way the Task Scheduler Service validates certain file operations. An attacker who successfully exploited the vulnerability could gain elevated privileges on a victim system. To exploit the vulnerability, an attacker would require unprivileged code execution on a victim system. The security update addresses the vulnerability by correctly validating file operations.

• CWE-59Improper Link Resolution Before File Access ('Link Following')The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.