{
  "advisories": [
    {
      "id": "EUVD-2020-2132",
      "source": "euvd",
      "title": "An elevation of privilege vulnerability exists in the way the Update Notification Manager handles files.To exploit this vulnerability, an attacker would first have to gain execution on the victim system, aka 'Update Notification Manager Elevation of Privilege Vulnerability'.",
      "url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-2132"
    }
  ],
  "cve": "CVE-2020-0638",
  "epss": {
    "score": 0.02351
  },
  "kev": {
    "dateAdded": "2022-05-23T00:00:00+00:00",
    "dueDate": "2022-06-13T00:00:00+00:00"
  },
  "mitre": {
    "cpes": [],
    "created": "2020-01-14T23:11:35+00:00",
    "description": "An elevation of privilege vulnerability exists in the way the Update Notification Manager handles files.To exploit this vulnerability, an attacker would first have to gain execution on the victim system, aka 'Update Notification Manager Elevation of Privilege Vulnerability'.",
    "metrics": {
      "cvssV2_0": {},
      "cvssV3_0": {},
      "cvssV3_1": {},
      "cvssV4_0": {}
    },
    "mitre_repo_path": "cves/2020/0xxx/CVE-2020-0638.json",
    "references": [
      "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0638"
    ],
    "title": null,
    "updated": "2026-08-12T03:56:03.563000+00:00",
    "vendors": [],
    "weaknesses": []
  },
  "nvd": {
    "cpes": [
      "cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:arm64:*",
      "cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:x64:*",
      "cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:arm64:*",
      "cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:x64:*",
      "cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:arm64:*",
      "cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x64:*",
      "cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x86:*",
      "cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:arm64:*",
      "cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:x64:*",
      "cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:x86:*",
      "cpe:2.3:o:microsoft:windows_10_1909:-:*:*:*:*:*:arm64:*",
      "cpe:2.3:o:microsoft:windows_10_1909:-:*:*:*:*:*:x64:*",
      "cpe:2.3:o:microsoft:windows_10_1909:-:*:*:*:*:*:x86:*",
      "cpe:2.3:o:microsoft:windows_server_1803:-:*:*:*:*:*:*:*",
      "cpe:2.3:o:microsoft:windows_server_1903:-:*:*:*:*:*:*:*",
      "cpe:2.3:o:microsoft:windows_server_1909:-:*:*:*:*:*:*:*",
      "cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*"
    ],
    "created": "2020-01-14T23:15:32.503000+00:00",
    "description": "An elevation of privilege vulnerability exists in the way the Update Notification Manager handles files.To exploit this vulnerability, an attacker would first have to gain execution on the victim system, aka 'Update Notification Manager Elevation of Privilege Vulnerability'.",
    "metrics": {
      "cvssV2_0": {
        "score": 4.6,
        "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"
      },
      "cvssV3_0": {},
      "cvssV3_1": {
        "score": 7.8,
        "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
      },
      "cvssV4_0": {}
    },
    "nvd_repo_path": "2020/CVE-2020-0638.json",
    "references": [
      "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0638",
      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-0638"
    ],
    "title": null,
    "updated": "2026-08-12T05:17:27.463000+00:00",
    "vendors": [
      "microsoft",
      "microsoft$PRODUCT$windows_10_1709",
      "microsoft$PRODUCT$windows_10_1803",
      "microsoft$PRODUCT$windows_10_1809",
      "microsoft$PRODUCT$windows_10_1903",
      "microsoft$PRODUCT$windows_10_1909",
      "microsoft$PRODUCT$windows_server_1803",
      "microsoft$PRODUCT$windows_server_1903",
      "microsoft$PRODUCT$windows_server_1909",
      "microsoft$PRODUCT$windows_server_2019"
    ],
    "weaknesses": [
      "CWE-59",
      "NVD-CWE-noinfo"
    ]
  },
  "opencve": {
    "changes": [
      {
        "created": "2025-02-07T16:15:00+00:00",
        "data": [
          {
            "details": {
              "added": [
                "CWE-59"
              ],
              "removed": []
            },
            "type": "weaknesses"
          },
          {
            "details": {
              "added": {
                "kev": {
                  "dateAdded": "2022-05-23"
                },
                "ssvc": {
                  "options": {
                    "Automatable": "no",
                    "Exploitation": "active",
                    "Technical Impact": "total"
                  },
                  "version": "2.0.3"
                }
              },
              "removed": {},
              "updated": {}
            },
            "type": "metrics"
          }
        ],
        "id": "36fdd824-468e-4e10-bcab-0e230caadef3"
      },
      {
        "created": "2025-04-08T16:30:00+00:00",
        "data": [
          {
            "details": [
              "microsoft$PRODUCT$windows_10_1709",
              "microsoft$PRODUCT$windows_10_1803",
              "microsoft$PRODUCT$windows_10_1809",
              "microsoft$PRODUCT$windows_10_1903",
              "microsoft$PRODUCT$windows_10_1909",
              "microsoft$PRODUCT$windows_server_1803",
              "microsoft$PRODUCT$windows_server_1903",
              "microsoft$PRODUCT$windows_server_1909"
            ],
            "type": "first_time"
          },
          {
            "details": {
              "added": [
                "cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:arm64:*",
                "cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:x64:*",
                "cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:arm64:*",
                "cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:x64:*",
                "cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:arm64:*",
                "cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x64:*",
                "cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x86:*",
                "cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:arm64:*",
                "cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:x64:*",
                "cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:x86:*",
                "cpe:2.3:o:microsoft:windows_10_1909:-:*:*:*:*:*:arm64:*",
                "cpe:2.3:o:microsoft:windows_10_1909:-:*:*:*:*:*:x64:*",
                "cpe:2.3:o:microsoft:windows_10_1909:-:*:*:*:*:*:x86:*",
                "cpe:2.3:o:microsoft:windows_server_1803:-:*:*:*:*:*:*:*",
                "cpe:2.3:o:microsoft:windows_server_1903:-:*:*:*:*:*:*:*",
                "cpe:2.3:o:microsoft:windows_server_1909:-:*:*:*:*:*:*:*"
              ],
              "removed": [
                "cpe:2.3:o:microsoft:windows_10:1709:*:*:*:*:*:*:*",
                "cpe:2.3:o:microsoft:windows_10:1803:*:*:*:*:*:*:*",
                "cpe:2.3:o:microsoft:windows_10:1809:*:*:*:*:*:*:*",
                "cpe:2.3:o:microsoft:windows_10:1903:*:*:*:*:*:*:*",
                "cpe:2.3:o:microsoft:windows_10:1909:*:*:*:*:*:*:*",
                "cpe:2.3:o:microsoft:windows_server_2016:1803:*:*:*:*:*:*:*",
                "cpe:2.3:o:microsoft:windows_server_2016:1903:*:*:*:*:*:*:*",
                "cpe:2.3:o:microsoft:windows_server_2016:1909:*:*:*:*:*:*:*"
              ]
            },
            "type": "cpes"
          },
          {
            "details": {
              "added": [
                "microsoft$PRODUCT$windows_10_1709",
                "microsoft$PRODUCT$windows_10_1803",
                "microsoft$PRODUCT$windows_10_1809",
                "microsoft$PRODUCT$windows_10_1903",
                "microsoft$PRODUCT$windows_10_1909",
                "microsoft$PRODUCT$windows_server_1803",
                "microsoft$PRODUCT$windows_server_1903",
                "microsoft$PRODUCT$windows_server_1909"
              ],
              "removed": [
                "microsoft$PRODUCT$windows_10",
                "microsoft$PRODUCT$windows_server_2016"
              ]
            },
            "type": "vendors"
          }
        ],
        "id": "e1bc67a9-fe0d-43f7-9888-a319d353fb9f"
      },
      {
        "created": "2025-10-21T19:30:00+00:00",
        "data": [
          {
            "details": {
              "added": [
                "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-0638"
              ],
              "removed": []
            },
            "type": "references"
          }
        ],
        "id": "836de246-976e-4e7d-b823-0b6766315780"
      },
      {
        "created": "2025-10-21T20:30:00+00:00",
        "data": [
          {
            "details": {
              "added": [],
              "removed": [
                "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-0638"
              ]
            },
            "type": "references"
          }
        ],
        "id": "aea5ce50-ec63-4c7a-9c69-eec8b3655080"
      },
      {
        "created": "2025-10-22T00:15:00+00:00",
        "data": [
          {
            "details": {
              "added": [
                "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-0638"
              ],
              "removed": []
            },
            "type": "references"
          }
        ],
        "id": "924d53cc-40fd-49e7-aa85-40058cd1f8aa"
      }
    ],
    "cpes": {
      "data": [
        "cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:arm64:*",
        "cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:x64:*",
        "cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:arm64:*",
        "cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:x64:*",
        "cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:arm64:*",
        "cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x64:*",
        "cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x86:*",
        "cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:arm64:*",
        "cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:x64:*",
        "cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:x86:*",
        "cpe:2.3:o:microsoft:windows_10_1909:-:*:*:*:*:*:arm64:*",
        "cpe:2.3:o:microsoft:windows_10_1909:-:*:*:*:*:*:x64:*",
        "cpe:2.3:o:microsoft:windows_10_1909:-:*:*:*:*:*:x86:*",
        "cpe:2.3:o:microsoft:windows_server_1803:-:*:*:*:*:*:*:*",
        "cpe:2.3:o:microsoft:windows_server_1903:-:*:*:*:*:*:*:*",
        "cpe:2.3:o:microsoft:windows_server_1909:-:*:*:*:*:*:*:*",
        "cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*"
      ],
      "providers": [
        "nvd"
      ]
    },
    "created": {
      "data": "2020-01-14T23:11:35+00:00",
      "provider": "mitre"
    },
    "description": {
      "data": "An elevation of privilege vulnerability exists in the way the Update Notification Manager handles files.To exploit this vulnerability, an attacker would first have to gain execution on the victim system, aka 'Update Notification Manager Elevation of Privilege Vulnerability'.",
      "provider": "mitre"
    },
    "metrics": {
      "cvssV2_0": {
        "data": {
          "score": 4.6,
          "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"
        },
        "provider": "nvd"
      },
      "cvssV3_0": {
        "data": {},
        "provider": null
      },
      "cvssV3_1": {
        "data": {
          "score": 7.8,
          "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        },
        "provider": "vulnrichment"
      },
      "cvssV4_0": {
        "data": {},
        "provider": null
      },
      "epss": {
        "data": {
          "score": 0.02351
        },
        "provider": "first"
      },
      "kev": {
        "data": {
          "dateAdded": "2022-05-23T00:00:00+00:00",
          "dueDate": "2022-06-13T00:00:00+00:00"
        },
        "provider": "cisa"
      },
      "ssvc": {
        "data": {
          "options": {
            "Automatable": "no",
            "Exploitation": "active",
            "Technical Impact": "total"
          },
          "version": "2.0.3"
        },
        "provider": "vulnrichment"
      },
      "threat_severity": {
        "data": null,
        "provider": null
      }
    },
    "references": {
      "data": [
        "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0638",
        "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-0638"
      ],
      "providers": [
        "mitre",
        "nvd",
        "vulnrichment"
      ]
    },
    "title": {
      "data": null,
      "provider": null
    },
    "updated": {
      "data": "2025-10-29T14:33:40.940000+00:00",
      "provider": "nvd"
    },
    "vendors": {
      "data": [
        "microsoft",
        "microsoft$PRODUCT$windows_10_1709",
        "microsoft$PRODUCT$windows_10_1803",
        "microsoft$PRODUCT$windows_10_1809",
        "microsoft$PRODUCT$windows_10_1903",
        "microsoft$PRODUCT$windows_10_1909",
        "microsoft$PRODUCT$windows_server_1803",
        "microsoft$PRODUCT$windows_server_1903",
        "microsoft$PRODUCT$windows_server_1909",
        "microsoft$PRODUCT$windows_server_2019"
      ],
      "providers": [
        "nvd"
      ]
    },
    "weaknesses": {
      "data": [
        "CWE-59",
        "NVD-CWE-noinfo"
      ],
      "providers": [
        "nvd",
        "vulnrichment"
      ]
    }
  },
  "vulnrichment": {
    "cpes": [],
    "created": "2020-01-14T23:11:35+00:00",
    "description": "An elevation of privilege vulnerability exists in the way the Update Notification Manager handles files.To exploit this vulnerability, an attacker would first have to gain execution on the victim system, aka 'Update Notification Manager Elevation of Privilege Vulnerability'.",
    "metrics": {
      "cvssV2_0": {},
      "cvssV3_0": {},
      "cvssV3_1": {
        "score": 7.8,
        "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
      },
      "cvssV4_0": {},
      "kev": {
        "dateAdded": "2022-05-23"
      },
      "ssvc": {
        "options": {
          "Automatable": "no",
          "Exploitation": "active",
          "Technical Impact": "total"
        },
        "version": "2.0.3"
      }
    },
    "references": [
      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-0638"
    ],
    "title": null,
    "updated": "2025-02-07T15:19:00.510000+00:00",
    "vendors": [],
    "vulnrichment_repo_path": "2020/0xxx/CVE-2020-0638.json",
    "weaknesses": [
      "CWE-59"
    ]
  }
}