[ CVE-2020-0683 · Published 11 Feb 2020 ]
Microsoft Windows Installer Privilege Escalation Vulnerability
Exploited · CISA KEV CVSS 7.8
EPSS 8%Fix available
[ Why it matters ]Priority signals
- Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2021-11-03
[ Description ]Official description
An elevation of privilege vulnerability exists in the Windows Installer when MSI packages process symbolic links, aka 'Windows Installer Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0686.
CISA: Microsoft Windows Installer contains a privilege escalation vulnerability when MSI packages process symbolic links, which allows attackers to bypass access restrictions to add or remove files.
[ Fixes ]Fixes and patches
CISA required action (US federal deadline 3 May 2022): Apply updates per vendor instructions.
- Patch on portal.msrc.microsoft.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD
[ References ]References
- portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0683PatchVendor Advisory
- www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource