CVE-2020-1112
HighCVSS 8.5Exploitation Probability (EPSS)
High risk89th percentile - higher than 89% of all known CVEs
Summary
Elevation of privilege vulnerability in the Windows BITS IIS module that improperly handles uploaded content. An attacker with BITS upload permissions could upload restricted file types to an IIS-hosted folder.
Risk Assessment
Potential to place malicious files on an IIS server, leading to further attacks such as code execution or privilege escalation.
Recommendation
Install the security update that corrects how Windows BITS validates file names.
Other vulnerabilities in Windows BITS
Original NVD description (English source)
An elevation of privilege vulnerability exists when the Windows Background Intelligent Transfer Service (BITS) IIS module improperly handles uploaded content. An attacker who successfully exploited this vulnerability could upload restricted file types to an IIS-hosted folder. To exploit this vulnerability, an attacker would require permissions to upload files via BITS. An attacker could then submit a specially crafted request to upload a file. The security update addresses the vulnerability by correcting how Windows BITS validates file names.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS