PT-2020-2942 · Microsoft · Windows Defender

Published 2020-06-09 · Updated 2021-07-21 · CVE-2020-1170

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Windows Defender (affected versions not specified)

Description The issue is related to an elevation of privilege vulnerability in Windows Defender, which can lead to arbitrary file deletion on the system. To exploit this, an attacker must first log on to the system. The vulnerability is associated with insufficient access control in Windows Defender, allowing an attacker to potentially elevate their privileges using a specially crafted application.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Privilege Management

Incorrect Permission

Weakness Enumeration

CWE-269

CWE-732

Related Identifiers

BDU:2020-03099

CVE-2020-1170

Affected Products

Windows Defender

References · 6

• 🔥 http://packetstormsecurity.com/files/160919/Cloud-Filter-Arbitrary-File-Creation-Privilege-Escalation.html · Exploit
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1170 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-03099 · Security Note
• https://osv.dev/vulnerability/CVE-2020-1170 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-1170 · Security Note
• https://t.me/cybersecuritytechnologies/1304 · Telegram Post