Описание
Microsoft OneDrive Elevation of Privilege Vulnerability
An elevation of privilege vulnerability exists in Microsoft OneDrive that allows file deletion in arbitrary locations.
To exploit the vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application that could exploit the vulnerability and take control of an affected system.
The update addresses the vulnerability by correcting how Microsoft OneDrive handles file operations.
FAQ
Do I need to take any action to protect myself from this vulnerability?
Most customers have been protected from this vulnerability because OneDrive has its own updater that periodically checks and updates the OneDrive binary. If your network is air-gapped, you can update the binary from the link in the Security Updates table.
In which situations does this vulnerability apply?
This vulnerability only applies when OneDrive is installed per machine and does not apply to the default per user install. Please see Per Machine Installation for more information.
Which release contains the updates to protect against the vulnerability?
The update is in the following release:
- 20.114.0607.0002 for all rings
Возможность эксплуатации
Publicly Disclosed
Exploited
Latest Software Release
Older Software Release
DOS
EPSS
Связанные уязвимости
An elevation of privilege vulnerability exists in Microsoft OneDrive that allows file deletion in arbitrary locations.To exploit the vulnerability, an attacker would first have to log on to the system, aka 'Microsoft OneDrive Elevation of Privilege Vulnerability'.
An elevation of privilege vulnerability exists in Microsoft OneDrive that allows file deletion in arbitrary locations.To exploit the vulnerability, an attacker would first have to log on to the system, aka 'Microsoft OneDrive Elevation of Privilege Vulnerability'.
Уязвимость службы размещения файлов OneDrive for Windows, связанная с недостатками разграничения доступа, позволяющая нарушителю повысить свои привилегии
EPSS