Permissions, Privileges, and Access Controls in Microsoft Windows and Windows Server - CVE-2020-1048
Published: May 12, 2020 / Updated: July 3, 2023
Vulnerability identifier: #VU27837
CSH Severity: Low
CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-1048
CWE-ID: CWE-264
Exploitation vector: Local access
Exploit availability:
Public exploit is available
Vulnerability details
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to the Windows Print Spooler service improperly allows arbitrary writing to the file system. A local user can use a specially crafted application to execute arbitrary code on the target system with elevated privileges.
Affected software
Microsoft Windows
Windows Server
Windows Server
How to mitigate CVE-2020-1048
Install update from vendor's website.
Links to Public Exploits and PoC-codes
- Exploit #9170 - cve-2020-1048 (spoolsv.exe arb file write poc) (July 3, 2023)
- Exploit #4635 - CVE-2020-1048 (An elevation of privilege vulnerability exists when the Windows Print Spooler service improperly allows arbitrary writing to the file system, aka 'Windows Print Spooler Elevation of Privilege Vulnerability'.) (September 21, 2020)
- Exploit #4626 - Microsoft Spooler Local Privilege Elevation Vulnerability (September 18, 2020)
- Exploit #4509 - CVE-2020-1337 (CVE-2020-1048 bypass: binary planting PoC) (August 21, 2020)
- Exploit #3579 - CVE-2020-1337-exploit (CVE-2020-1337 Windows Print Spooler Privilege Escalation) (July 22, 2020)
- Exploit #3495 - CVE-2020-1048 (POC exploit code for CVE-2020-1048(PrintDemon)) (July 15, 2020)
- Exploit #2973 - CVE-2009-0229-PoC (PoC for CVE-2009-0229 "Print Spooler Read File Vulnerability" LPE AFR (related to CVE-2020-1048)) (June 3, 2020)