CVE-2021-41526

2023-03-2921:15:07

[email protected]

web.nvd.nist.gov

windows

installer

msi

vulnerability

privilege escalation

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

Confidence

High

EPSS

Percentile

5.1%

JSON

A vulnerability has been reported in the windows installer (MSI) built with InstallScript custom action. This vulnerability may allow privilege escalation when invoked ‘repair’ of the MSI which has an InstallScript custom action.

Affected configurations

Nvd

Node

flexerarevenera_installshieldRange<2021windows

flexerarevenera_installshieldMatch2021-windows

flexerarevenera_installshieldMatch2021r1windows

VendorProductVersionCPE
flexerarevenera_installshield*cpe:2.3:a:flexera:revenera_installshield:*:*:*:*:*:windows:*:*
flexerarevenera_installshield2021cpe:2.3:a:flexera:revenera_installshield:2021:-:*:*:*:windows:*:*
flexerarevenera_installshield2021cpe:2.3:a:flexera:revenera_installshield:2021:r1:*:*:*:windows:*:*

Vendor	Product	Version	CPE
flexera	revenera_installshield	*	cpe:2.3:a:flexera:revenera_installshield::::::windows::*
flexera	revenera_installshield	2021	cpe:2.3:a:flexera:revenera_installshield:2021:-::::windows::*
flexera	revenera_installshield	2021	cpe:2.3:a:flexera:revenera_installshield:2021:r1::::windows::*

References

seclists.org/fulldisclosure/2024/Apr/24

community.flexera.com/t5/InstallShield-Knowledge-Base/CVE-2021-41526-Privilege-escalation-vulnerability-during-MSI/ta-p/218137/jump-to/first-unread-message

github.com/mandiant/Vulnerability-Disclosures/blob/master/MNDT-2021-0011/MNDT-2021-0011.md