CVE-2019-1142

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

An elevation of privilege vulnerability exists when the .NET Framework common language runtime (CLR) allows file creation in arbitrary locations, aka '.NET Framework Elevation of Privilege Vulnerability'.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-22

Affected software

VendorProductVersions
MicrosoftMicrosoft .NET Framework 4.5.2Windows Server 2012; Windows Server 2012 (Server Core installation); Windows 8.1 for 32-bit systems; Windows 8.1 for x64-based systems; Windows Server 2012 R2; Windows RT 8.1; Windows Server 2012 R2 (Server Core installation)
MicrosoftMicrosoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2Windows Server 2012; Windows Server 2012 (Server Core installation); Windows 8.1 for 32-bit systems; Windows 8.1 for x64-based systems; Windows Server 2012 R2; Windows RT 8.1; Windows Server 2012 R2 (Server Core installation)
MicrosoftMicrosoft .NET Framework 4.8 on Windows Server 2012unspecified
MicrosoftMicrosoft .NET Framework 4.8 on Windows Server 2012 (Server Core installation)unspecified
MicrosoftMicrosoft .NET Framework 4.8 on Windows 8.1 for 32-bit systemsunspecified
MicrosoftMicrosoft .NET Framework 4.8 on Windows 8.1 for x64-based systemsunspecified
MicrosoftMicrosoft .NET Framework 4.8 on Windows Server 2012 R2unspecified
MicrosoftMicrosoft .NET Framework 4.8 on Windows RT 8.1unspecified
MicrosoftMicrosoft .NET Framework 4.8 on Windows Server 2012 R2 (Server Core installation)unspecified
MicrosoftMicrosoft .NET Framework 4.8 on Windows Server 2016unspecified
MicrosoftMicrosoft .NET Framework 4.8 on Windows 10 Version 1607 for 32-bit Systemsunspecified
MicrosoftMicrosoft .NET Framework 4.8 on Windows 10 Version 1607 for x64-based Systemsunspecified
MicrosoftMicrosoft .NET Framework 4.8 on Windows Server 2016 (Server Core installation)unspecified
MicrosoftMicrosoft .NET Framework 4.8 on Windows 10 Version 1703 for 32-bit Systemsunspecified
MicrosoftMicrosoft .NET Framework 4.8 on Windows 10 Version 1703 for x64-based Systemsunspecified
MicrosoftMicrosoft .NET Framework 4.8 on Windows 10 Version 1709 for 32-bit Systemsunspecified
MicrosoftMicrosoft .NET Framework 4.8 on Windows 10 Version 1709 for x64-based Systemsunspecified
MicrosoftMicrosoft .NET Framework 4.8 on Windows 10 Version 1803 for 32-bit Systemsunspecified
MicrosoftMicrosoft .NET Framework 4.8 on Windows 10 Version 1803 for x64-based Systemsunspecified
MicrosoftMicrosoft .NET Framework 4.8 on Windows Server, version 1803 (Server Core Installation)unspecified
MicrosoftMicrosoft .NET Framework 3.5 AND 4.8 on Windows 10 Version 1809 for 32-bit Systemsunspecified
MicrosoftMicrosoft .NET Framework 3.5 AND 4.8 on Windows 10 Version 1809 for x64-based Systemsunspecified
MicrosoftMicrosoft .NET Framework 3.5 AND 4.8 on Windows Server 2019unspecified
MicrosoftMicrosoft .NET Framework 3.5 AND 4.8 on Windows Server 2019 (Server Core installation)unspecified
MicrosoftMicrosoft .NET Framework 3.5 AND 4.8 on Windows 10 Version 1903 for 32-bit Systemsunspecified
MicrosoftMicrosoft .NET Framework 3.5 AND 4.8 on Windows 10 Version 1903 for x64-based Systemsunspecified
MicrosoftMicrosoft .NET Framework 3.5 AND 4.8 on Windows Server, version 1903 (Server Core installation)1903
MicrosoftMicrosoft .NET Framework 3.5 AND 4.7.2 on Windows 10 Version 1809 for 32-bit Systemsunspecified
MicrosoftMicrosoft .NET Framework 3.5 AND 4.7.2 on Windows 10 Version 1809 for x64-based Systemsunspecified
MicrosoftMicrosoft .NET Framework 3.5 AND 4.7.2 on Windows Server 2019unspecified
MicrosoftMicrosoft .NET Framework 3.5 AND 4.7.2 on Windows Server 2019 (Server Core installation)unspecified
MicrosoftMicrosoft .NET Framework 3.5Windows Server 2012; Windows Server 2012 (Server Core installation); Windows 8.1 for 32-bit systems; Windows 8.1 for x64-based systems; Windows Server 2012 R2; Windows Server 2012 R2 (Server Core installation); Windows 10 for 32-bit Systems; Windows 10 for x64-based Systems; Windows Server 2016; Windows 10 Version 1607 for 32-bit Systems; Windows 10 Version 1607 for x64-based Systems; Windows Server 2016 (Server Core installation); Windows 10 Version 1703 for 32-bit Systems; Windows 10 Version 1703 for x64-based Systems; Windows 10 Version 1709 for 32-bit Systems; Windows 10 Version 1709 for x64-based Systems; Windows 10 Version 1803 for 32-bit Systems; Windows 10 Version 1803 for x64-based Systems; Windows Server, version 1803 (Server Core Installation)

References

Timeline

Published
Sep 11, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-114266.1An XSS issue was discovered in app/admincp/template/admincp.header.php in idreamsoft iCMS 7.0.14 via the admincp.php?app=config tab parameteCVE-2019-114276.1An XSS issue was discovered in app/search/search.app.php in idreamsoft iCMS 7.0.14 via the public/api.php?app=search q parameter.CVE-2019-114286.1I, Librarian 4.10 has XSS via the export.php export_files parameter.CVE-2019-114294.8CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.793 (Free/Open Source Version), 0.9.8.753 (Pro) and 0.9.8.807 (Pro) is vulnerable to ReCVE-2019-11435.5An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory. An attacker wCVE-2019-11448.8A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts. An attacker CVE-2019-114447.2An issue was discovered in Liferay Portal CE 7.1.2 GA3. An attacker can use Liferay's Groovy script console to execute OS commands. CommandsCVE-2019-114457.2OpenKM 6.3.2 through 6.3.7 allows an attacker to upload a malicious JSP file into the /okm:root directories and move that file to the home dCVE-2019-114468.8An issue was discovered in ATutor through 2.2.4. It allows the user to run commands on the server with the teacher user privilege. The UploaCVE-2019-114478.8An issue was discovered in CutePHP CuteNews 2.1.2. An attacker can infiltrate the server through the avatar upload process in the profile arCVE-2019-114489.8An issue was discovered in Zoho ManageEngine Applications Manager 11.0 through 14.0. An unauthenticated user can gain the authority of SYSTECVE-2019-114496.1I, Librarian 4.10 has XSS via the notes.php notes parameter.
CVE-2019-1142: Medium severity, CVSS 5.5 | Vulnix