PT-2022-11422 · Microsoft · Windows Installer

Ronnie Salomonsen · Published 2022-05-06 · Updated 2024-04-19 · CVE-2021-41526

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Windows Installer (MSI) built with InstallScript custom action (affected versions not specified)

Description A vulnerability has been reported in the Windows Installer (MSI) built with InstallScript custom action, which may allow privilege escalation when the 'repair' of the MSI is invoked.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2021-41526

Affected Products

Windows Installer

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2021-41526 · Security Note
• https://community.flexera.com/t5/InstallShield-Knowledge-Base/CVE-2021-41526-Privilege-escalation-vulnerability-during-MSI/ta-p/218137/jump-to/first-unread-message · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-41526 · Vendor Advisory
• https://github.com/mandiant/Vulnerability-Disclosures/blob/master/MNDT-2021-0011/MNDT-2021-0011.md · Note
• http://seclists.org/fulldisclosure/2024/Apr/24 · Note
• https://t.me/cibsecurity/61146 · Telegram Post
• https://t.me/cibsecurity/42153 · Telegram Post
• https://t.me/cvenotify/77445 · Telegram Post
• https://t.me/cibsecurity/42139 · Telegram Post
• https://t.me/cibsecurity/42146 · Telegram Post