Описание
Microsoft Defender Elevation of Privilege Vulnerability
External control of file name or path in Microsoft Defender for Endpoint allows an authorized attacker to elevate privileges locally.
FAQ
How can I verify that the update is installed?
Customers wanting to ensure the client has been updated can run the MDE Client Analyzer on the device. When running the analyzer on a Windows device that does not have the security update, the analyzer will present a warning (ID 121035) indicating missing patch and directing to relevant online article. Additionally, if the update is installed, but the Anti-Spoofing capability is not in a stable state, the analyzer will present warning (ID 121036) indicating an issue and providing additional online guidance or callout to reach out to Microsoft support if issue persists.
What privileges could be gained by an attacker who successfully exploited this vulnerability?
An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.
Обновления
| Продукт | Статья | Обновление |
|---|---|---|
| Microsoft Defender for Endpoint for Linux |
Показывать по
Возможность эксплуатации
Publicly Disclosed
Exploited
Latest Software Release
DOS
EPSS
6.7 Medium
CVSS3
Связанные уязвимости
External control of file name or path in Microsoft Defender for Endpoint allows an authorized attacker to elevate privileges locally.
External control of file name or path in Microsoft Defender for Endpoint allows an authorized attacker to elevate privileges locally.
Уязвимость Защитника Microsoft (Microsoft Defender for Endpoint) операционных систем Linux, связанная с некорректным внешним управлением именем или путем файла, позволяющая нарушителю повысить свои привилегии
EPSS
6.7 Medium
CVSS3