CVE-2020-1030

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

<p>An elevation of privilege vulnerability exists when the Windows Print Spooler service improperly allows arbitrary writing to the file system. An attacker who successfully exploited this vulnerability could run arbitrary code with elevated system privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p> <p>To exploit this vulnerability, an attacker would have to log on to an affected system and run a specially crafted script or application.</p> <p>The update addresses the vulnerability by correcting how the Windows Print Spooler Component writes to the file system.</p>

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

No affected versions have been published.

Timeline

Published
Sep 11, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-10317.5<p>An information disclosure vulnerability exists in the way that the Windows Server DHCP service improperly discloses the contents of its mCVE-2020-10329.0A remote code execution vulnerability exists when Hyper-V RemoteFX vGPU on a host server fails to properly validate input from an authenticaCVE-2020-10334.0<p>An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory. An attacker who successfullyCVE-2020-10346.8<p>An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory. An attacker who successfullyCVE-2020-10357.5A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory. The vulnerability could corrupt CVE-2020-10369.0A remote code execution vulnerability exists when Hyper-V RemoteFX vGPU on a host server fails to properly validate input from an authenticaCVE-2020-103647.5The SSH daemon on MikroTik routers through v6.44.3 could allow remote attackers to generate CPU activity, trigger refusal of new authorized CVE-2020-103656.5LogicalDoc before 8.3.3 allows SQL Injection. LogicalDoc populates the list of available documents by querying the database. This list couldCVE-2020-103667.5LogicalDoc before 8.3.3 allows /servlet.gupld Directory Traversal, a different vulnerability than CVE-2020-9423 and CVE-2020-10365.CVE-2020-103675.5Certain Cypress (and Broadcom) Wireless Combo chips, when a January 2021 firmware update is not present, allow memory access via a "Spectra"CVE-2020-103683.5Certain Cypress (and Broadcom) Wireless Combo chips, when a January 2021 firmware update is not present, allow memory read access via a "SpeCVE-2020-103695.5Certain Cypress (and Broadcom) Wireless Combo chips, when a January 2021 firmware update is not present, allow inferences about memory conte
CVE-2020-1030: High severity, CVSS 7.8 | Vulnix