CVE-2019-1129 : An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard li

An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1130.

Published 2019-07-15 19:15:21

Updated 2020-08-24 17:37:01

Source Microsoft Corporation

View at NVD, CVE.org

Vulnerability category: Gain privilege

CVE-2019-1129 is in the CISA Known Exploited Vulnerabilities Catalog

This issue is known to have been leveraged as part of a ransomware campaign.

CISA vulnerability name:

Microsoft Windows AppX Deployment Service (AppXSVC) Privilege Escalation Vulnerability

CISA required action:

Apply updates per vendor instructions.

CISA description:

A privilege escalation vulnerability exists when Windows AppXSVC improperly handles hard links. An attacker who successfully exploited this vulnerability could run processes in an elevated context.

Added on 2022-03-15 Action due date 2022-04-05

Exploit prediction scoring system (EPSS) score for CVE-2019-1129

Probability of exploitation activity in the next 30 days: 88.08%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 99 % EPSS Score History EPSS FAQ

CVSS scores for CVE-2019-1129

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.2	HIGH	AV:L/AC:L/Au:N/C:C/I:C/A:C	3.9	10.0	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete
7.8	HIGH	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	1.8	5.9	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2019-1129

CWE-59 Improper Link Resolution Before File Access ('Link Following')

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2019-1129

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1129

CVE-2019-1129 | Windows Elevation of Privilege Vulnerability
Patch;Vendor Advisory

Products affected by CVE-2019-1129