Multiple vulnerabilities in Microsoft Windows WalletService
| Risk | Low |
| Patch available | YES |
| Number of vulnerabilities | 2 |
| CVE-ID | CVE-2020-17037 CVE-2020-16999 |
| CWE-ID | CWE-264 CWE-200 |
| Exploitation vector | Local |
| Public exploit | N/A |
| Vulnerable software Subscribe |
Windows Operating systems & Components / Operating system |
| Vendor | Microsoft |
Security Bulletin
This security bulletin contains information about 2 vulnerabilities.
1) Permissions, Privileges, and Access Controls
EUVDB-ID: #VU48290
Risk: Low
CVSSv3.1:
CVE-ID: CVE-2020-17037
CWE-ID:
CWE-264 - Permissions, Privileges, and Access Controls
Exploit availability: No
DescriptionThe vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to application does not properly impose security restrictions in Windows WalletService, which leads to security restrictions bypass and privilege escalation.
MitigationInstall updates from vendor's website.
Vulnerable software versionsWindows: 10 - 10 2004
CPE2.3 External linkshttp://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-17037
Q & A
Can this vulnerability be exploited remotely?
Is there known malware, which exploits this vulnerability?
2) Information disclosure
EUVDB-ID: #VU48291
Risk: Low
CVSSv3.1:
CVE-ID: CVE-2020-16999
CWE-ID:
CWE-200 - Information exposure
Exploit availability: No
DescriptionThe vulnerability allows a local user to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output by the application in Windows WalletService. A local user can gain unauthorized access to sensitive information on the system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsWindows: 10 - 10 2004
CPE2.3 External linkshttp://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16999
Q & A
Can this vulnerability be exploited remotely?
Is there known malware, which exploits this vulnerability?
