CVE-2019-1142 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	5.5 MEDIUM	LOCAL	LOW	LOW	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Base Score

CVSS 3.x

EPSS Score

Percentile: 63%

Affected Products (NVD)

Vendor	Product	Version
microsoft	.net_framework	3.5
microsoft	.net_framework	3.5
microsoft	.net_framework	4.7.2
microsoft	.net_framework	4.6
microsoft	.net_framework	4.6.1
microsoft	.net_framework	4.6.2
microsoft	.net_framework	4.7
microsoft	.net_framework	4.7.1
microsoft	.net_framework	4.7.2
microsoft	.net_framework	4.8
microsoft	.net_framework	3.5
microsoft	.net_framework	4.8
microsoft	.net_framework	4.5.2

𝑥

= Vulnerable software versions

Windows Releases

Platform

Version

Windows 10

(x64, x86)	KB4516070
1607 (x64, x86)	KB4516044
1607 (x64, x86)	KB4514354
1703 (x64, x86)	KB4514355
1703 (x64, x86)	KB4516068
1709 (x64, x86)	KB4516066
1709 (x64, x86)	KB4514356
1803 (x64, x86)	KB4516058
1803 (x64, x86)	KB4514357
1809 (x64, x64, x86, x86)	KB4514601
1903 (x64, x86)	KB4514359

Windows 8.1

(x64, x64, x64, x64, x86, x86, x86)	KB4514604
(x64, x64, x86, x86)	KB4514599

Windows RT 8.1

All

Windows Server

1803 Server Core	KB4516058
1903 Server Core	KB4514359

Windows Server 2012

Server Core	KB4514603
Standard	KB4514603

Windows Server 2012 R2

Server Core	KB4514604
Server Core	KB4514599
Standard	KB4514604
Standard	KB4514599

Windows Server 2016

Server Core	KB4514354
Server Core	KB4516044
Standard	KB4514354
Standard	KB4516044

Windows Server 2019

Server Core	KB4514601
Standard	KB4514601

Common Weakness Enumeration

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1142

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1142