CVE-2020-1511

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

An elevation of privilege vulnerability exists when Connected User Experiences and Telemetry Service improperly handles file operations. An attacker who successfully exploited this vulnerability could run processes in an elevated context. An attacker could exploit this vulnerability by running a specially crafted application on the victim system. The security update addresses the vulnerability by correcting how the Connected User Experiences and Telemetry Service handles file operations.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

No affected versions have been published.

Timeline

Published: Aug 17, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-151108.1In jupyterhub-kubespawner before 0.12, certain usernames will be able to craft particular server names which will grant them access to the d CVE-2020-151115.4In Fiber before version 1.12.6, the filename that is given in c.Attachment() (https://docs.gofiber.io/ctx#attachment) is not escaped, and th CVE-2020-151126.5In etcd before versions 3.3.23 and 3.4.10, it is possible to have an entry index greater then the number of entries in the ReadAll method in CVE-2020-151137.1In etcd before versions 3.3.23 and 3.4.10, certain directory paths are created (etcd data directory and the directory path when provided to CVE-2020-151147.7In etcd before versions 3.3.23 and 3.4.10, the etcd gateway is a simple TCP proxy to allow for basic service discovery and access. However, CVE-2020-151157.5etcd before versions 3.3.23 and 3.4.10 does not perform any password length validation, which allows for very short passwords, such as those CVE-2020-151176.5In Synergy before version 1.12.0, a Synergy server can be crashed by receiving a kMsgHelloBack packet with a client name length set to 0xfff CVE-2020-151185.4In Wagtail before versions 2.7.4 and 2.9.3, when a form page type is made available to Wagtail editors through the `wagtail.contrib.forms` a CVE-2020-151195.4In auth0-lock versions before and including 11.25.1, dangerouslySetInnerHTML is used to update the DOM. When dangerouslySetInnerHTML is used CVE-2020-15127.8An information disclosure vulnerability exists when the Windows State Repository Service improperly handles objects in memory. An attacker w CVE-2020-151204.9In "I hate money" before version 4.1.5, an authenticated member of one project can modify and delete members of another project, without kno CVE-2020-151219.6In radare2 before version 4.5.0, malformed PDB file names in the PDB server path cause shell injection. To trigger the problem it's required