{"containers": {"cna": {"title": "Windows Setup Elevation of Privilege Vulnerability", "datePublic": "2020-10-13T07:00:00.000Z", "affected": [{"vendor": "Microsoft", "product": "Windows 10 Version 1803", "cpes": [], "platforms": ["32-bit Systems", "x64-based Systems", "ARM64-based Systems"], "versions": [{"version": "N/A", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Windows 10 Version 1809", "cpes": [], "platforms": ["32-bit Systems", "x64-based Systems", "ARM64-based Systems"], "versions": [{"version": "N/A", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Windows 10 Version 1909", "cpes": [], "platforms": ["32-bit Systems", "x64-based Systems", "ARM64-based Systems"], "versions": [{"version": "N/A", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Windows 10 Version 1903 for 32-bit Systems", "cpes": [], "platforms": ["Unknown"], "versions": [{"version": "N/A", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Windows 10 Version 1903 for x64-based Systems", "cpes": [], "platforms": ["Unknown"], "versions": [{"version": "N/A", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Windows 10 Version 1903 for ARM64-based Systems", "cpes": [], "platforms": ["Unknown"], "versions": [{"version": "N/A", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Windows 10 Version 2004", "cpes": [], "platforms": ["32-bit Systems", "ARM64-based Systems", "x64-based Systems"], "versions": [{"version": "N/A", "status": "affected"}]}], "descriptions": [{"value": "<p>An elevation of privilege vulnerability exists in Windows Setup in the way it handles directories.</p>\n<p>A locally authenticated attacker could run arbitrary code with elevated system privileges. After successfully exploiting the vulnerability, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p>\n<p>The security update addresses the vulnerability by ensuring Windows Setup properly handles directories.</p>", "lang": "en-US"}], "problemTypes": [{"descriptions": [{"description": "Elevation of Privilege", "lang": "en-US", "type": "Impact"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2023-12-31T19:20:11.297Z"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16908"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "baseSeverity": "HIGH", "baseScore": 7.8, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C"}}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T13:45:34.654Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16908"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-01-10T16:56:47.953890Z", "id": "CVE-2020-16908", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-15T16:59:48.937Z"}}]}, "cveMetadata": {"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "assignerShortName": "microsoft", "cveId": "CVE-2020-16908", "datePublished": "2020-10-16T22:17:44.000Z", "dateReserved": "2020-08-04T00:00:00.000Z", "dateUpdated": "2024-11-15T16:59:48.937Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16908", "tags": ["x_refsource_MISC", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T13:45:34.654Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2020-16908", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-01-10T16:56:47.953890Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-15T16:59:43.711Z"}}], "cna": {"title": "Windows Setup Elevation of Privilege Vulnerability", "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C"}, "scenarios": [{"lang": "en-US", "value": "GENERAL"}]}], "affected": [{"cpes": [], "vendor": "Microsoft", "product": "Windows 10 Version 1803", "versions": [{"status": "affected", "version": "N/A"}], "platforms": ["32-bit Systems", "x64-based Systems", "ARM64-based Systems"]}, {"cpes": [], "vendor": "Microsoft", "product": "Windows 10 Version 1809", "versions": [{"status": "affected", "version": "N/A"}], "platforms": ["32-bit Systems", "x64-based Systems", "ARM64-based Systems"]}, {"cpes": [], "vendor": "Microsoft", "product": "Windows 10 Version 1909", "versions": [{"status": "affected", "version": "N/A"}], "platforms": ["32-bit Systems", "x64-based Systems", "ARM64-based Systems"]}, {"cpes": [], "vendor": "Microsoft", "product": "Windows 10 Version 1903 for 32-bit Systems", "versions": [{"status": "affected", "version": "N/A"}], "platforms": ["Unknown"]}, {"cpes": [], "vendor": "Microsoft", "product": "Windows 10 Version 1903 for x64-based Systems", "versions": [{"status": "affected", "version": "N/A"}], "platforms": ["Unknown"]}, {"cpes": [], "vendor": "Microsoft", "product": "Windows 10 Version 1903 for ARM64-based Systems", "versions": [{"status": "affected", "version": "N/A"}], "platforms": ["Unknown"]}, {"cpes": [], "vendor": "Microsoft", "product": "Windows 10 Version 2004", "versions": [{"status": "affected", "version": "N/A"}], "platforms": ["32-bit Systems", "ARM64-based Systems", "x64-based Systems"]}], "datePublic": "2020-10-13T07:00:00+00:00", "references": [{"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16908", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en-US", "value": "<p>An elevation of privilege vulnerability exists in Windows Setup in the way it handles directories.</p>\n<p>A locally authenticated attacker could run arbitrary code with elevated system privileges. After successfully exploiting the vulnerability, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p>\n<p>The security update addresses the vulnerability by ensuring Windows Setup properly handles directories.</p>\n"}], "problemTypes": [{"descriptions": [{"lang": "en-US", "type": "Impact", "description": "Elevation of Privilege"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2023-12-31T19:20:11.297Z"}}}, "cveMetadata": {"cveId": "CVE-2020-16908", "state": "PUBLISHED", "dateUpdated": "2024-11-15T16:59:48.937Z", "dateReserved": "2020-08-04T00:00:00", "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "datePublished": "2020-10-16T22:17:44", "assignerShortName": "microsoft"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows_10:1803:*:*:*:*:*:*:*", "matchCriteriaId": "7CB85C75-4D35-480E-843D-60579EC75FCB", "vulnerable": true}, {"criteria": "cpe:2.3:o:microsoft:windows_10:1809:*:*:*:*:*:*:*", "matchCriteriaId": "6B8F3DD2-A145-4AF1-8545-CC42892DA3D1", "vulnerable": true}, {"criteria": "cpe:2.3:o:microsoft:windows_10:1903:*:*:*:*:*:*:*", "matchCriteriaId": "3FB5CDAE-C713-4D9D-9D6A-2C2E8924A4BB", "vulnerable": true}, {"criteria": "cpe:2.3:o:microsoft:windows_10:1909:*:*:*:*:*:*:*", "matchCriteriaId": "E9273B95-20ED-4547-B0A8-95AD15B30372", "vulnerable": true}, {"criteria": "cpe:2.3:o:microsoft:windows_10:2004:*:*:*:*:*:*:*", "matchCriteriaId": "AAE74AF3-C559-4645-A6C0-25C3D647AAC8", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "<p>An elevation of privilege vulnerability exists in Windows Setup in the way it handles directories.</p>\n<p>A locally authenticated attacker could run arbitrary code with elevated system privileges. After successfully exploiting the vulnerability, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p>\n<p>The security update addresses the vulnerability by ensuring Windows Setup properly handles directories.</p>"}, {"lang": "es", "value": "Se presenta una vulnerabilidad de escalada de privilegios en Windows Setup en la manera que maneja directorios. Un atacante autenticado localmente podr\u00eda ejecutar c\u00f3digo arbitrario con privilegios elevados del sistema, tambi\u00e9n se conoce como \"Windows Setup Elevation of Privilege Vulnerability\""}], "id": "CVE-2020-16908", "lastModified": "2026-02-23T18:21:20.817", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 7.2, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "secure@microsoft.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Secondary"}]}, "published": "2020-10-16T23:15:14.133", "references": [{"source": "secure@microsoft.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16908"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16908"}], "sourceIdentifier": "secure@microsoft.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}