SB2021011225 - Multiple vulnerabilities in Microsoft Windows CSC Service

Main Vulnerability Database SB2021011225

SB2021011225 - Multiple vulnerabilities in Microsoft Windows CSC Service

Published: January 12, 2021

Security Bulletin ID SB2021011225

CSH Severity

Low

Patch available

YES

Number of vulnerabilities 7

Exploitation vector Local access

Highest impact Code execution

Breakdown by Severity

Low
Medium
High
Critical

Description

This security bulletin contains information about 7 vulnerabilities.

1) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2021-1688)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in Windows CSC Service, which leads to security restrictions bypass and privilege escalation.

2) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2021-1654)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in Windows CSC Service, which leads to security restrictions bypass and privilege escalation.

3) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2021-1659)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in Windows CSC Service, which leads to security restrictions bypass and privilege escalation.

4) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2021-1655)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in Windows CSC Service, which leads to security restrictions bypass and privilege escalation.

5) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2021-1653)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in Windows CSC Service, which leads to security restrictions bypass and privilege escalation.

6) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2021-1652)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in Windows CSC Service, which leads to security restrictions bypass and privilege escalation.

7) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2021-1693)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in Windows CSC Service, which leads to security restrictions bypass and privilege escalation.

Remediation

Install update from vendor's website.

References