CVE-2020-16910: microsoft windows_10 Improper Preservation of Permissions

Vulnerability summary

CVE-2020-16910 is a medium (CVSS 6.2) Improper Preservation of Permissions vulnerability in microsoft windows_10. EPSS estimates a 2.79% chance of exploitation in the next 30 days, higher than 86.2% of scored vulnerabilities.

Timeline

1. 16-10-2020
   PublishedVulnerability first disclosed.
2. 04-08-2024
   Last modifiedVulnerability information updated.

Description

<p>A security feature bypass vulnerability exists when Microsoft Windows fails to handle file creation permissions, which could allow an attacker to create files in a protected Unified Extensible Firmware Interface (UEFI) location.</p> <p>To exploit this vulnerability, an attacker could run a specially crafted application to bypass Unified Extensible Firmware Interface (UEFI) variable security in Windows.</p> <p>The security update addresses the vulnerability by correcting security feature behavior to enforce permissions.</p>

• CWE-281Improper Preservation of PermissionsThe product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.