CVE-2020-1337

An elevation of privilege vulnerability exists when the Windows Print Spooler service improperly allows arbitrary writing to the file system. An attacker who successfully exploited this vulnerability could run arbitrary code with elevated system privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. To exploit this vulnerability, an attacker would have to log on to an affected system and run a specially crafted script or application. The update addresses the vulnerability by correcting how the Windows Print Spooler Component writes to the file system.

• CWE-367

• http://packetstormsecurity.com/files/160028/Microsoft-Windows-Local-Spooler-Bypass.htmlExploit, Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/160993/Microsoft-Spooler-Local-Privilege-Elevation.htmlExploit, Third Party Advisory, VDB Entry
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1337Patch, Vendor Advisory
• http://packetstormsecurity.com/files/160028/Microsoft-Windows-Local-Spooler-Bypass.htmlExploit, Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/160993/Microsoft-Spooler-Local-Privilege-Elevation.htmlExploit, Third Party Advisory, VDB Entry
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1337Patch, Vendor Advisory

Published

Aug 17, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-1336An elevation of privilege vulnerability exists in the way th…7.8
• CVE-2020-13360Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2020-13361In QEMU 5.0.0 and earlier, es1370_transfer_audio in hw/audio…3.9
• CVE-2020-13362In QEMU 5.0.0 and earlier, megasas_lookup_frame in hw/scsi/m…3.2
• CVE-2020-13364A backdoor in certain Zyxel products allows remote TELNET ac…8.8
• CVE-2020-13365Certain Zyxel products have a locally accessible binary that…8.8
• CVE-2020-13376SecurEnvoy SecurMail 9.3.503 allows attackers to upload exec…9
• CVE-2020-13377The web-services interface of Loadbalancer.org Enterprise VA…8.1
• CVE-2020-13378Loadbalancer.org Enterprise VA MAX through 8.3.8 has an OS C…8.8
• CVE-2020-13379The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSR…8.2
• CVE-2020-1338<p>A remote code execution vulnerability exists in Microsoft…7.8
• CVE-2020-13380openSIS before 7.4 allows SQL Injection.9.8