CVE-2021-41526

· HIGHModified

← All CVEs

CVSS v3.1

7.8

EPSS

0.28%

Published

Mar 29, 2023

Modified

Nov 21, 2024

Public PoC / Exploit (1)

All weaponized →

TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

A vulnerability has been reported in the windows installer (MSI) built with InstallScript custom action. This vulnerability may allow privilege escalation when invoked ‘repair’ of the MSI which has an InstallScript custom action.

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected Products (3)

flexera · revenera_installshield (up to 2021)vulnerable

flexera · revenera_installshieldvulnerable

References (6)

http://seclists.org/fulldisclosure/2024/Apr/24

https://community.flexera.com/t5/InstallShield-Knowledge-Base/CVE-2021-41526-Privilege-escalation-vulnerability-during-MSI/ta-p/218137/jump-to/first-unread-message

Vendor Advisory

https://github.com/mandiant/Vulnerability-Disclosures/blob/master/MNDT-2021-0011/MNDT-2021-0011.md

Third Party Advisory

http://seclists.org/fulldisclosure/2024/Apr/24

https://community.flexera.com/t5/InstallShield-Knowledge-Base/CVE-2021-41526-Privilege-escalation-vulnerability-during-MSI/ta-p/218137/jump-to/first-unread-message

Vendor Advisory

https://github.com/mandiant/Vulnerability-Disclosures/blob/master/MNDT-2021-0011/MNDT-2021-0011.md

Third Party Advisory

KEV Catalog EPSS Scores Vendors All CVEs