CVE-2019-1397

HighCVSS 8.4/10Last modified Jun 17, 2026

Description

A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest operating system, aka 'Windows Hyper-V Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1389, CVE-2019-1398.

Metrics

CVSS 3.1 8.4/10CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
Microsoft	Windows	7 for x64-based Systems Service Pack 1; 8.1 for x64-based systems; 10 for x64-based Systems; 10 Version 1607 for x64-based Systems; 10 Version 1709 for x64-based Systems; 10 Version 1803 for x64-based Systems; 10 Version 1809 for x64-based Systems
Microsoft	Windows Server	2008 R2 for x64-based Systems Service Pack 1 (Core installation); 2008 R2 for x64-based Systems Service Pack 1; 2012; 2012 (Core installation); 2012 R2; 2012 R2 (Core installation); 2016; 2016 (Core installation); version 1803 (Core Installation); 2019; 2019 (Core installation); 2008 for x64-based Systems Service Pack 2; 2008 for x64-based Systems Service Pack 2 (Core installation)
Microsoft	Windows 10 Version 1903 for x64-based Systems	unspecified
Microsoft	Windows Server, version 1903 (Server Core installation)	unspecified

References

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1397Patch, Vendor Advisory
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1397Patch, Vendor Advisory

Timeline

Published: Nov 12, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-139706.1In antSword before 2.1.0, self-XSS in the database configuration leads to code execution via modules/database/asp/index.js, modules/database CVE-2019-139716.1OTCMS 3.81 allows XSS via the mode parameter in an apiRun.php?mudi=autoRun request.CVE-2019-139726.1LayerBB 1.1.3 allows XSS via the application/commands/new.php pm_title variable, a related issue to CVE-2019-17997.CVE-2019-139739.8LayerBB 1.1.3 allows admin/general.php arbitrary file upload because the custom_logo filename suffix is not restricted, and .php may be used CVE-2019-139748.8LayerBB 1.1.3 allows conversations.php/cmd/new CSRF.CVE-2019-139756.1eGain Chat 15.0.3 allows HTML Injection.CVE-2019-139769.8eGain Chat 15.0.3 allows unrestricted file upload.CVE-2019-139775.4index.php in Ovidentia 8.4.3 has XSS via tg=groups, tg=maildoms&idx=create&userid=0&bgrp=y, tg=delegat, tg=site&idx=create, tg=site&item=4, CVE-2019-139788.8Ovidentia 8.4.3 has SQL Injection via the id parameter in an index.php?tg=delegat&idx=mem request.CVE-2019-139798.8In Directus 7 API before 2.2.1, uploading of PHP files is not blocked, leading to uploads/_/originals remote code execution.CVE-2019-13988.4A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated us CVE-2019-139808.8In Directus 7 API through 2.3.0, uploading of PHP files is blocked only when the Apache HTTP Server is used, leading to uploads/_/originals