PT-2019-3645 · Microsoft · Windows 10 Update Assistant

Published 2019-10-08 · Updated 2020-08-24 · CVE-2019-1378

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Windows 10 Update Assistant (affected versions not specified)

Description An issue exists in the way Windows 10 Update Assistant handles permissions, allowing a locally authenticated attacker to run arbitrary code with elevated system privileges. This could potentially lead to exploitation, enabling an attacker to execute code with higher privileges than intended.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Privilege Management

Incorrect Permission

Weakness Enumeration

CWE-269

CWE-732

Related Identifiers

BDU:2019-03860

CVE-2019-1378

Affected Products

Windows 10 Update Assistant

References · 3

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1378 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-1378 · Security Note
• https://bdu.fstec.ru/vul/2019-03860 · Security Note