An elevation of privilege exists in SyncController.dll. An attacker who successfully exploited the vulnerability could run arbitrary code with elevated privileges.
To exploit the vulnerability, an attacker could run a specially crafted application that could exploit the vulnerability. This vulnerability by itself does not allow arbitrary code to be run. However, this vulnerability could be used in conjunction with one or more vulnerabilities (e.g. a remote code execution vulnerability and another elevation of privilege) that could take advantage of the elevated privileges when running.
The update addresses the vulnerability by correcting how the SyncController.dll handles processes these requests.
References
| Link | Resource |
|---|---|
| https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1198 | Patch Vendor Advisory |
| https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1198 | Patch Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 04:36
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1198 - Patch, Vendor Advisory |
29 May 2024, 17:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : 7.5
v3 : 6.5 |
| Summary | (en) An elevation of privilege exists in SyncController.dll. An attacker who successfully exploited the vulnerability could run arbitrary code with elevated privileges. To exploit the vulnerability, an attacker could run a specially crafted application that could exploit the vulnerability. This vulnerability by itself does not allow arbitrary code to be run. However, this vulnerability could be used in conjunction with one or more vulnerabilities (e.g. a remote code execution vulnerability and another elevation of privilege) that could take advantage of the elevated privileges when running. The update addresses the vulnerability by correcting how the SyncController.dll handles processes these requests. |
Information
Published : 2019-08-14 21:15
Updated : 2024-11-21 04:36
NVD link : CVE-2019-1198
Mitre link : CVE-2019-1198
CVE.ORG link : CVE-2019-1198
JSON object : View
Products Affected
microsoft
- windows_server_2019
- windows_10
- windows_server_2016
CWE