[ CVE-2019-1253 · Published 11 Sep 2019 ]
Microsoft Windows AppX Deployment Server Privilege Escalation Vulnerability
Exploited · CISA KEV CVSS 7.8
EPSS 12%Fix available
[ Why it matters ]Priority signals
- Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2022-03-15
- Known to be used in ransomware campaigns
- EPSS: 12% chance of exploitation in the next 30 days (higher than 96% of CVEs)
[ Description ]Official description
An elevation of privilege vulnerability exists when the Windows AppX Deployment Server improperly handles junctions.To exploit this vulnerability, an attacker would first have to gain execution on the victim system, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1215, CVE-2019-1278, CVE-2019-1303.
CISA: A privilege escalation vulnerability exists when the Windows AppX Deployment Server improperly handles junctions.
[ Fixes ]Fixes and patches
CISA required action (US federal deadline 5 Apr 2022): Apply updates per vendor instructions.
- Patch on portal.msrc.microsoft.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD
[ References ]References
- packetstormsecurity.com/files/154488/AppXSvc-17763.1.amd64fre.rs5_release.180914-1434-P…Third Party AdvisoryVDB Entry
- portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1253PatchVendor Advisory
- www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource