PT-2020-2281 · Microsoft · Onedrive For Windows

Zhiniang Peng · Published 2020-04-14 · Updated 2020-04-21 · CVE-2020-0935

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Medium

Base vector

AV:L/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions OneDrive for Windows (affected versions not specified)

Description The issue arises from the improper handling of symbolic links by the OneDrive for Windows Desktop application, potentially allowing an attacker to elevate their privileges using a specially crafted application.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

BDU:2020-02227

CVE-2020-0935

Affected Products

Onedrive For Windows

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2020-0935 · Security Note
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0935 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-02227 · Security Note