CVE-2020-1277

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

An elevation of privilege vulnerability exists in Windows Installer because of the way Windows Installer handles certain filesystem operations.To exploit the vulnerability, an attacker would require unprivileged execution on the victim system, aka 'Windows Installer Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-1272, CVE-2020-1302, CVE-2020-1312.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
Microsoft	Windows	10 Version 1809 for 32-bit Systems; 10 Version 1809 for x64-based Systems; 10 Version 1809 for ARM64-based Systems
Microsoft	Windows Server	2019; 2019 (Core installation)
Microsoft	Windows 10 Version 1909 for 32-bit Systems	unspecified
Microsoft	Windows 10 Version 1909 for x64-based Systems	unspecified
Microsoft	Windows 10 Version 1909 for ARM64-based Systems	unspecified
Microsoft	Windows Server, version 1909 (Server Core installation)	unspecified
Microsoft	Windows 10 Version 1903 for 32-bit Systems	unspecified
Microsoft	Windows 10 Version 1903 for x64-based Systems	unspecified
Microsoft	Windows 10 Version 1903 for ARM64-based Systems	unspecified
Microsoft	Windows Server, version 1903 (Server Core installation)	unspecified
Microsoft	Windows 10 Version 2004 for 32-bit Systems	unspecified
Microsoft	Windows 10 Version 2004 for ARM64-based Systems	unspecified
Microsoft	Windows 10 Version 2004 for x64-based Systems	unspecified
Microsoft	Windows Server, version 2004 (Server Core installation)	unspecified

References

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1277Patch, Vendor Advisory
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1277Patch, Vendor Advisory

Timeline

Published: Jun 9, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-127706.7An issue was discovered in the Linux kernel through 5.6.11. sg_write lacks an sg_remove_request call in a certain failure case, aka CID-83c6 CVE-2020-127715.5An issue was discovered in the Linux kernel through 5.6.11. btree_gc_coalesce in drivers/md/bcache/btree.c has a deadlock if a coalescing op CVE-2020-127728.8An issue was discovered in Ignite Realtime Spark 2.8.3 (and the ROAR plugin for it) on Windows. A chat message can include an IMG element wi CVE-2020-127738.8A security misconfiguration vulnerability exists in the SDK of some Realtek ADSL/PON Modem SoC firmware, which allows attackers using a defa CVE-2020-127746.7D-Link DSL-7740C does not properly validate user input, which allows an authenticated LAN user to inject arbitrary command.CVE-2020-127759.8Hicos citizen certificate client-side component does not filter special characters for command parameters in specific web URLs. An unauthent CVE-2020-127767.2Openfind Mail2000 contains Broken Access Control vulnerability, which can be used to execute unauthorized commands after attackers obtain th CVE-2020-127777.5A function in Combodo iTop contains a vulnerability of Broken Access Control, which allows unauthorized attacker to inject command and discl CVE-2020-127786.1Combodo iTop does not validate inputted parameters, attackers can inject malicious commands and launch XSS attack.CVE-2020-127795.4Combodo iTop contains a stored Cross-site Scripting vulnerability, which can be attacked by uploading file with malicious script.CVE-2020-12787.8An elevation of privilege vulnerability exists when the Diagnostics Hub Standard Collector Service improperly handles file operations, aka 'CVE-2020-127807.5A security misconfiguration exists in Combodo iTop, which can expose sensitive information.