CVE-2020-1286

high · 8.8

A remote code execution vulnerability exists when the Windows Shell does not properly validate file paths.An attacker who successfully exploited this vulnerability could run arbitrary code in the context of the current user, aka 'Windows Shell Remote Code Execution Vulnerability'.

8.8

CVSS

11.8%

EPSS (exploit prob.)

96th

EPSS percentile

2020-06-09

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weaknesses

CWE-20

Affected products

Vendor	Product	Affected versions
microsoft	windows_10	1803
microsoft	windows_10	1809
microsoft	windows_10	1903
microsoft	windows_10	1909
microsoft	windows_10	2004
microsoft	windows_server_2016	1803
microsoft	windows_server_2016	1903
microsoft	windows_server_2016	1909
microsoft	windows_server_2016	2004
microsoft	windows_server_2019	all versions

Check a specific version with /api/v1/cve/match.

References

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1286
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1286

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2020-1286