CVE-2020-1540 - Windows Backup Engine Elevation of Privilege Vulnerability

Back Back to CVE browser

HIGH

Windows Backup Engine Elevation of Privilege Vulnerability

Published Aug 17, 2020

7.8

HIGH

CVSS 3.1

EPSS 0.91%

Description

An elevation of privilege vulnerability exists when the Windows Backup Engine improperly handles memory. To exploit this vulnerability, an attacker would first have to gain execution on the victim system. An attacker could then run a specially crafted application to elevate privileges. The security update addresses the vulnerability by correcting how the Windows Backup Engine handles memory.

Affected products

Vendor Microsoft Product Windows 10 Version 1507 Default
n/a
- Version
  10.0.0
  Status
  affected
  Constraints
  <publication
Vendor Microsoft Product Windows 10 Version 1607 Default
n/a
- Version
  10.0.0
  Status
  affected
  Constraints
  <publication
Vendor Microsoft Product Windows 10 Version 1709 Default
n/a
- Version
  10.0.0
  Status
  affected
  Constraints
  <publication
Vendor Microsoft Product Windows 10 Version 1709 for 32-bit Systems Default
n/a
- Version
  10.0.0
  Status
  affected
  Constraints
  <publication
Vendor Microsoft Product Windows 10 Version 1803 Default
n/a
- Version
  10.0.0
  Status
  affected
  Constraints
  <publication
Vendor Microsoft Product Windows 10 Version 1809 Default
n/a
- Version
  10.0.0
  Status
  affected
  Constraints
  <publication
Vendor Microsoft Product Windows 10 Version 1903 for 32-bit Systems Default
n/a
- Version
  10.0.0
  Status
  affected
  Constraints
  <publication
Vendor Microsoft Product Windows 10 Version 1903 for ARM64-based Systems Default
n/a
- Version
  10.0.0
  Status
  affected
  Constraints
  <publication
Vendor Microsoft Product Windows 10 Version 1903 for x64-based Systems Default
n/a
- Version
  10.0.0
  Status
  affected
  Constraints
  <publication
Vendor Microsoft Product Windows 10 Version 1909 Default
n/a
- Version
  10.0.0
  Status
  affected
  Constraints
  <publication
Vendor Microsoft Product Windows 10 Version 2004 Default
n/a
- Version
  10.0.0
  Status
  affected
  Constraints
  <publication
Vendor Microsoft Product Windows 7 Default
n/a
- Version
  6.1.0
  Status
  affected
  Constraints
  <publication
Vendor Microsoft Product Windows 7 Service Pack 1 Default
n/a
- Version
  6.1.0
  Status
  affected
  Constraints
  <publication
Vendor Microsoft Product Windows 8.1 Default
n/a
- Version
  6.3.0
  Status
  affected
  Constraints
  <publication

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Microsoft

Windows 10 Version 1507

n/a

Version	Status	Constraints
10.0.0	affected	<publication

Microsoft

Windows 10 Version 1607

n/a

Version	Status	Constraints
10.0.0	affected	<publication

Microsoft

Windows 10 Version 1709

n/a

Version	Status	Constraints
10.0.0	affected	<publication

Microsoft

Windows 10 Version 1709 for 32-bit Systems

n/a

Version	Status	Constraints
10.0.0	affected	<publication

Microsoft

Windows 10 Version 1803

n/a

Version	Status	Constraints
10.0.0	affected	<publication

Microsoft

Windows 10 Version 1809

n/a

Version	Status	Constraints
10.0.0	affected	<publication

Microsoft

Windows 10 Version 1903 for 32-bit Systems

n/a

Version	Status	Constraints
10.0.0	affected	<publication

Microsoft

Windows 10 Version 1903 for ARM64-based Systems

n/a

Version	Status	Constraints
10.0.0	affected	<publication

Microsoft

Windows 10 Version 1903 for x64-based Systems

n/a

Version	Status	Constraints
10.0.0	affected	<publication

Microsoft

Windows 10 Version 1909

n/a

Version	Status	Constraints
10.0.0	affected	<publication

Microsoft

Windows 10 Version 2004

n/a

Version	Status	Constraints
10.0.0	affected	<publication

Microsoft

Windows 7

n/a

Version	Status	Constraints
6.1.0	affected	<publication

Microsoft

Windows 7 Service Pack 1

n/a

Version	Status	Constraints
6.1.0	affected	<publication

Microsoft

Windows 8.1

n/a

Version	Status	Constraints
6.3.0	affected	<publication

Remediation

No remediation recorded yet.

Weaknesses (0)

No CWE recorded.

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-12414
Advisory
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1540
x_refsource_MISCPatchVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-12414		Advisory
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1540		x_refsource_MISCPatchVendor Advisory