CVE-2020-16852 OneDrive for Windows Elevation of Privilege Vulnerability
An attacker with local access can exploit improper symbolic link handling in OneDrive to overwrite or delete files with elevated privileges.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-16852?
CVE-2020-16852 is a high-severity vulnerability in Microsoft OneDrive for Windows, published on 11 Sep 2020. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
<p>An elevation of privilege vulnerability exists when the OneDrive for Windows Desktop application improperly handles symbolic links. An attacker who successfully exploited this vulnerability could overwrite a targeted file with an elevated status.</p> <p>To exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application that could exploit the vulnerability and delete a targeted file with an elevated status.</p> <p>The update addresses this vulnerability by correcting where the OneDrive updater performs file writes while running with elevation.</p>
Which versions are affected by CVE-2020-16852?
It affects 1 product.
Products include Microsoft Onedrive.
How do I fix CVE-2020-16852?
No fix has been published for CVE-2020-16852 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-16852 being exploited?
There is no known exploitation of CVE-2020-16852 in the wild and no public exploit code.
Other vulnerabilities in Microsoft OneDrive for Windows
- CVE-2020-0654 Security feature bypass in One Drive for Android
- CVE-2023-24930 Microsoft OneDrive for MacOS Elevation of Privilege Vulnerability
- CVE-2020-1465 Privilege escalation in OneDrive for Windows
- CVE-2018-0592 Privilege escalation in Microsoft OneDrive
- CVE-2018-0593 Privilege escalation in The installer of Microsoft OneDrive
Sources
Also known as GHSA-62r3-326j-grw4.