CVE-2019-1129: Microsoft Windows AppX Deployment Service (AppXSVC) Privilege Escalation Vulnerability

High severity · published Jul 15, 2019

CVE-2019-1129

Microsoft Windows AppX Deployment Service (AppXSVC) Privilege Escalation Vulnerability

RansomwareIn wildKEV

7.8

CVSS

1.8%

EPSS

Yes

On KEV

Description

An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1130.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack vector

Local

Complexity

Low

Privileges

Low

User interaction

None

Confidentiality

High

Integrity

High

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)1.8% · higher than 78% of CVEs

Exploited in the wildYes

CISA KEVListed Mar 15, 2022

Federal remediation dueApr 5, 2022

Ransomware campaign useKnown

Affected products

Which versions

Windows · Microsoft

10 Version 1703 for 32-bit Systems; 10 Version 1703 for x64-based Systems; 10 Version 1709 for 32-bit Systems; 10 Version 1709 for x64-based Systems; 10 Version 1803 for 32-bit Systems; 10 Version 1803 for x64-based Systems; +5 more · source: vendor, KEV

Windows 10 Version 1903 for 32-bit Systems · Microsoft

All versions, or not specified · source: vendor

Windows 10 Version 1903 for ARM64-based Systems · Microsoft

All versions, or not specified · source: vendor

Windows 10 Version 1903 for x64-based Systems · Microsoft

All versions, or not specified · source: vendor

Windows Server, version 1903 (Server Core installation) · Microsoft

All versions, or not specified · source: vendor

Windows 10 1703 · Microsoft

All versions, or not specified · source: NVD

Windows 10 1709 · Microsoft

All versions, or not specified · source: NVD