CVE-2019-1322
Published: 10 October 2019
Summary
CVE-2019-1322 is a high-severity an unspecified weakness vulnerability in Microsoft Windows 10 1803. Its CVSS base score is 7.8 (High).
Operationally, ranked in the top 2.8% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).
Deeper analysis
An elevation of privilege vulnerability exists in Microsoft Windows when the operating system improperly handles authentication requests. The flaw, tracked as CVE-2019-1322 and distinct from CVE-2019-1320 and CVE-2019-1340, carries a CVSS 3.1 base score of 7.8 reflecting local attack vector, low complexity, and low privileges required to achieve full confidentiality, integrity, and availability impact.
A local attacker with limited privileges can exploit the issue to elevate rights on an affected system without user interaction. Successful exploitation grants the attacker the ability to execute code with higher privileges, potentially leading to complete control over the target host.
Microsoft's security advisory and associated patches address the vulnerability through updates that correct the improper handling of authentication requests. The flaw also appears in CISA's catalog of known exploited vulnerabilities, indicating confirmed real-world exploitation activity.
Packet Storm references describe related proof-of-concept material focused on UPnP components, consistent with the local privilege-escalation nature of the reported issue.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2019-9881
Vulnerability details
An elevation of privilege vulnerability exists when Windows improperly handles authentication requests, aka 'Microsoft Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1320, CVE-2019-1340.
- CWE(s)
- KEV Date Added
- 15 March 2022
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces approved access authorizations for logical access to the system, which the CVE bypasses via improper authentication-request handling.
Enforces the principle of least privilege so a local attacker cannot obtain full system rights even after exploiting the authentication flaw.
Requires timely installation of Microsoft patches that correct the improper authentication handling described in the CVE.