Published: 21/05/2020 Updated: 28/09/2020

CVSS v2 Base Score: 9.3 | Impact Score: 10 | Exploitability Score: 8.6

CVSS v3 Base Score: 7.5 | Impact Score: 5.9 | Exploitability Score: 1.6

VMScore: 828

Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C

A security feature bypass vulnerability exists in Microsoft Windows when the Task Scheduler service fails to properly verify client connections over RPC, aka 'Windows Task Scheduler Security Feature Bypass Vulnerability'.

Vulnerable Product	Search on Vulmon	Subscribe to Product
microsoft windows 10 -
microsoft windows 10 1607
microsoft windows 10 1709
microsoft windows 10 1803
microsoft windows 10 1809
microsoft windows 10 1903
microsoft windows 10 1909
microsoft windows 7 -
microsoft windows 8.1 -
microsoft windows rt 8.1 -
microsoft windows server 2008 -
microsoft windows server 2012 -
microsoft windows server 2012 r2
microsoft windows server 2016 -
microsoft windows server 2019 -
microsoft windows server 2019 1903
microsoft windows server 2019 1909

Compass Security identified a security feature bypass vulnerability in Microsoft Windows Due to the absence of integrity verification requirements for the RPC protocol and in particular the Task Scheduler, a man-in-the-middle attacker can relay his victim's NTLM authentication to a target of his choice over the RPC protocol Provided the victim ha ...

Full Disclosure mailing list archives   By Date By Thread </form>    CVE-2020-1113 - Windows Task Scheduler - Security Feature Bypass   ...

Study notes on Windows NTLM Reflection and token stealing based EOPs.

Awesome Windows Potatoes Study notes on Windows NTLM Reflection and token stealing based EOPs Misc RPC/Microsoft RPC/MSRPC (Microsoft Remote Procedure Call) -- is a modified version of DCE/RPC Additions include partial support for UCS-2 (but not Unicode) strings, implicit handles, and complex calculations in the variable-length string and structure paradigms already pre

CWE-295 https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1113 https://nvd.nist.gov https://github.com/bodik/awesome-potatoes https://packetstormsecurity.com/files/157730/Microsoft-Windows-Task-Scheduler-Security-Feature-Bypass.html

CVE-2020-1113

Vulnerability Summary

Vulnerability Trend

Exploits

Mailing Lists

Github Repositories

References

Vulmon Search

About

Products

Connect