Published: 09/06/2020 Updated: 21/07/2021

CVSS v2 Base Score: 7.2 | Impact Score: 10 | Exploitability Score: 3.9

CVSS v3 Base Score: 7.8 | Impact Score: 5.9 | Exploitability Score: 1.8

VMScore: 641

Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C

An elevation of privilege vulnerability exists in Windows Defender that leads arbitrary file deletion on the system.To exploit the vulnerability, an attacker would first have to log on to the system, aka 'Microsoft Windows Defender Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-1163.

Vulnerable Product	Search on Vulmon	Subscribe to Product
microsoft windows_defender -
microsoft forefront endpoint protection 2010 -
microsoft security essentials -
microsoft system center endpoint protection 2012

This Metasploit module exploits a vulnerability in cldfltsys The Cloud Filter driver on Windows 10 v1803 and later, prior to the December 2020 updates, did not set the IO_FORCE_ACCESS_CHECK or OBJ_FORCE_ACCESS_CHECK flags when calling FltCreateFileEx() and FltCreateFileEx2() within its HsmpOpCreatePlaceholders() function with attacker controlled ...

Weaponizing for Arbitrary Files/Directories Delete bugs to Get NT AUTHORITY\SYSTEM

Delete2SYSTEM Weaponizing for Arbitrary Files/Directories Delete bugs to Get NT AUTHORITY\SYSTEM Short Description: I just combined @jonasLyk's technique secretclub/2020/04/23/directory-deletion-shellhtml and one of technique from this article 0x00secorg/t/windows-defender-av-zero-day-vulnerability/22258 which using windows media player (service and fold

CWE-732 https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1170 http://packetstormsecurity.com/files/160919/Cloud-Filter-Arbitrary-File-Creation-Privilege-Escalation.html https://nvd.nist.gov https://github.com/sailay1996/delete2SYSTEM https://packetstormsecurity.com/files/160919/Cloud-Filter-Arbitrary-File-Creation-Privilege-Escalation.html

CVE-2020-1170

Vulnerability Summary

Vulnerability Trend

Exploits

Github Repositories

References

Vulmon Search

About

Products

Connect