CVE-2020-16939: microsoft windows_10 Link Following

Vulnerability summary

CVE-2020-16939 is a high (CVSS 7.8) Link Following vulnerability in microsoft windows_10. EPSS estimates a 2.42% chance of exploitation in the next 30 days, higher than 83.9% of scored vulnerabilities.

Timeline

1. 16-10-2020
   PublishedVulnerability first disclosed.
2. 04-08-2024
   Last modifiedVulnerability information updated.

Description

<p>An elevation of privilege vulnerability exists when Group Policy improperly checks access. An attacker who successfully exploited this vulnerability could run processes in an elevated context.</p> <p>To exploit the vulnerability, an attacker would first have to log on to the system, and then run a specially crafted application to take control over the affected system.</p> <p>The security update addresses the vulnerability by correcting how Group Policy checks access.</p>

• CWE-59Improper Link Resolution Before File Access ('Link Following')The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.