CVE-2019-1422

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

An elevation of privilege vulnerability exists in the way that the iphlpsvc.dll handles file creation allowing for a file overwrite, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1420, CVE-2019-1423.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-59

Affected software

VendorProductVersions
MicrosoftWindows7 for 32-bit Systems Service Pack 1; 7 for x64-based Systems Service Pack 1; 8.1 for 32-bit systems; 8.1 for x64-based systems; RT 8.1; 10 for 32-bit Systems; 10 for x64-based Systems; 10 Version 1607 for 32-bit Systems; 10 Version 1607 for x64-based Systems; 10 Version 1709 for 32-bit Systems; 10 Version 1709 for x64-based Systems; 10 Version 1803 for 32-bit Systems; 10 Version 1803 for x64-based Systems; 10 Version 1803 for ARM64-based Systems; 10 Version 1809 for 32-bit Systems; 10 Version 1809 for x64-based Systems; 10 Version 1809 for ARM64-based Systems; 10 Version 1709 for ARM64-based Systems
MicrosoftWindows Server2008 R2 for x64-based Systems Service Pack 1 (Core installation); 2008 R2 for Itanium-Based Systems Service Pack 1; 2008 R2 for x64-based Systems Service Pack 1; 2012; 2012 (Core installation); 2012 R2; 2012 R2 (Core installation); 2016; 2016 (Core installation); version 1803 (Core Installation); 2019; 2019 (Core installation)
MicrosoftWindows 10 Version 1903 for 32-bit Systemsunspecified
MicrosoftWindows 10 Version 1903 for x64-based Systemsunspecified
MicrosoftWindows 10 Version 1903 for ARM64-based Systemsunspecified
MicrosoftWindows Server, version 1903 (Server Core installation)unspecified

References

Timeline

Published
Nov 12, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-142206.5An issue was discovered in BlueStacks 4.110 and below on macOS and on 4.120 and below on Windows. BlueStacks employs Android running in a viCVE-2019-142215.41CRM On-Premise Software 8.5.7 allows XSS via a payload that is mishandled during a Run Report operation.CVE-2019-142229.8An issue was discovered in Alfresco Community Edition versions 6.0 and lower. An unauthenticated, remote attacker could authenticate to AlfrCVE-2019-142236.1An issue was discovered in Alfresco Community Edition versions below 5.2.6, 6.0.N and 6.1.N. The Alfresco Share application is vulnerable toCVE-2019-142247.2An issue was discovered in Alfresco Community Edition 5.2 201707. By leveraging multiple components in the Alfresco Software applications, aCVE-2019-142255.4OX App Suite 7.10.1 and 7.10.2 allows SSRF.CVE-2019-142268.1OX App Suite through 7.10.2 has Insecure Permissions.CVE-2019-142276.1OX App Suite 7.10.1 and 7.10.2 allows XSS.CVE-2019-142286.1Xavier PHP Management Panel 3.0 is vulnerable to Reflected POST-based XSS via the username parameter when registering a new user at admin/inCVE-2019-14237.8An elevation of privilege vulnerability exists in the way that the StartTileData.dll handles file creation in protected locations, aka 'WindCVE-2019-142309.8An issue was discovered in the Viral Quiz Maker - OnionBuzz plugin before 1.2.7 for WordPress. One could exploit the id parameter in the setCVE-2019-142319.8An issue was discovered in the Viral Quiz Maker - OnionBuzz plugin before 1.2.2 for WordPress. One could exploit the points parameter in the
CVE-2019-1422: High severity, CVSS 7.8 | Vulnix