CVE-2019-1162: microsoft windows_10 Improper Privilege Management

Vulnerability summary

CVE-2019-1162 is a high (CVSS 7.8) Improper Privilege Management vulnerability in microsoft windows_10. EPSS estimates a 0.88% chance of exploitation in the next 30 days, higher than 58.4% of scored vulnerabilities.

Timeline

1. 14-08-2019
   PublishedVulnerability first disclosed.
2. 04-08-2024
   Last modifiedVulnerability information updated.

Description

An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC). An attacker who successfully exploited this vulnerability could run arbitrary code in the security context of the local system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. To exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application that could exploit the vulnerability and take control over an affected system. The update addresses the vulnerability by correcting how Windows handles calls to ALPC.

• CWE-269Improper Privilege ManagementThe product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.