CVE-2019-1235
Last modified
CVE-2019-1235 is a high-severity vulnerability rated 7.8/10 on the CVSS scale. An elevation of privilege vulnerability exists in Windows Text Service Framework (TSF) when the TSF server process does not validate the source of input or commands it receives, aka 'Windows Text Service Framework Elevation of Privilege Vulnerability'.. EPSS estimates a 0.58% chance of exploitation in the next 30 days.
Description
An elevation of privilege vulnerability exists in Windows Text Service Framework (TSF) when the TSF server process does not validate the source of input or commands it receives, aka 'Windows Text Service Framework Elevation of Privilege Vulnerability'.
Metrics
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Microsoft | Windows 10 | All versions | — |
| Microsoft | Windows 10 | 1607 | — |
| Microsoft | Windows 10 | 1703 | — |
| Microsoft | Windows 10 | 1709 | — |
| Microsoft | Windows 10 | 1803 | — |
| Microsoft | Windows 10 | 1809 | — |
| Microsoft | Windows 10 | 1903 | — |
| Microsoft | Windows 7 | All versions | Sp1 |
| Microsoft | Windows 8.1 | All versions | — |
| Microsoft | Windows Rt 8.1 | All versions | — |
| Microsoft | Windows Server 2008 | All versions | Sp2 |
| Microsoft | Windows Server 2008 | r2 | Sp1 |
| Microsoft | Windows Server 2012 | All versions | — |
| Microsoft | Windows Server 2012 | r2 | — |
| Microsoft | Windows Server 2016 | All versions | — |
| Microsoft | Windows Server 2016 | 1803 | — |
| Microsoft | Windows Server 2016 | 1903 | — |
| Microsoft | Windows Server 2019 | All versions | — |
References
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1235Patch, Vendor Advisory
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1235Patch, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2019-1235?
How severe is CVE-2019-1235?
How do I fix CVE-2019-1235?
How Strix Helps
- Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2019
- CVE-2019-1234A spoofing vulnerability exists when Azure Stack fails to va…7.5
- CVE-2019-12345XSS exists in the Kiboko Hostel plugin before 1.1.4 for Word…
- CVE-2019-12346In the miniOrange SAML SP Single Sign On plugin before 4.8.7…
- CVE-2019-12347In pfSense 2.4.4-p3, a stored XSS vulnerability occurs when …
- CVE-2019-12348An issue was discovered in zzcms 2019. SQL Injection exists …9.8
- CVE-2019-12349An issue was discovered in zzcms 2019. SQL Injection exists …9.8
- CVE-2019-12350An issue was discovered in zzcms 2019. SQL Injection exists …9.8
- CVE-2019-12351An issue was discovered in zzcms 2019. SQL Injection exists …9.8
- CVE-2019-12352An issue was discovered in zzcms 2019. There is a SQL inject…8.8
- CVE-2019-12353An issue was discovered in zzcms 2019. There is a SQL inject…7.2
- CVE-2019-12354An issue was discovered in zzcms 2019. There is a SQL inject…7.2
- CVE-2019-12355An issue was discovered in zzcms 2019. There is a SQL inject…8.8
Are you affected by CVE-2019-1235?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST