Windows Update Service Elevation of Privilege Vulnerability · CVE-2021-26866 · GitHub Advisory Database · GitHub

Windows Update Service Elevation of Privilege Vulnerability

High severity Unreviewed Published May 24, 2022 to the GitHub Advisory Database • Updated Jan 29, 2023

Package

No package listed— Suggest a package

Affected versions

Unknown

Patched versions

Unknown

Description

Windows Update Service Elevation of Privilege Vulnerability

References

Published by the National Vulnerability Database

Mar 11, 2021

Published to the GitHub Advisory Database May 24, 2022

Last updated Jan 29, 2023

Weaknesses

CWE-59

Improper Link Resolution Before File Access ('Link Following')

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource. Learn more on MITRE.

CWE-269

Improper Privilege Management

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. Learn more on MITRE.