CVE-2021-41526

EUVD-2021-28545 · Published Mar 29, 2023

A vulnerability has been reported in the windows installer (MSI) built with InstallScript custom action. This vulnerability may allow privilege escalation when invoked ‘repair’ of the MSI which has an InstallScript custom action.

Technologies

Flexera Revenera Installshield

CVSS scores

v3.17.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

MITRE ATT&CK

Inferred

Where this vulnerability fits in an attack

ReconImpact

Privilege Escalation

T1068Exploitation for Privilege Escalation

References

http://seclists.org/fulldisclosure/2024/Apr/24
https://community.flexera.com/t5/InstallShield-Knowledge-Base/CVE-2021-41526-Privilege-escalation-vulnerability-during-MSI/ta-p/218137/jump-to/first-unread-message
https://github.com/mandiant/Vulnerability-Disclosures/blob/master/MNDT-2021-0011/MNDT-2021-0011.md

Potentially impacted assets

See if this affects your attack surface