3 ms·
From Microsoft's perspective, they consider local privilege elevation on a client computer an "important" vulnerability that requires patching and paying a bug
by MarkSweep 7y ago
From Microsoft's perspective, they consider local privilege elevation on a client computer an "important" vulnerability that requires patching and paying a bug bounty:
https://msrc-blog.microsoft.com/2018/09/10/microsoft-security-servicing-criteria-for-windows/ https://msrc-blog.microsoft.com/2018/09/10/microsoft-securit...
So some companies consider LPE to be serious.
- antisemiotic 7y agoIf Microsoft considered privilege escalation to be serious, they wouldn't have Windows setup a single privileged account on a fresh install. Or at the very least, they wouldn't make it necessary to jump through two hidden hoops to make a separate admin account without (a) a Microsoft profile and (b) without "secure questions" misfeature.