VulnerabilityModified
CVE-2021-41526
A vulnerability has been reported in the windows installer (MSI) built with InstallScript custom action.
HIGH 7.8EPSS 0.28%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.28%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
A vulnerability has been reported in the windows installer (MSI) built with InstallScript custom action. This vulnerability may allow privilege escalation when invoked ‘repair’ of the MSI which has an InstallScript custom action.
- CVSS 3.1
- 7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 0.28% probability · 21th percentile
- CISA KEV
- Not listed
- Affected
- flexera/revenera installshield
- Source
- PSIRT-CNA@flexerasoftware.com
References
- http://seclists.org/fulldisclosure/2024/Apr/24
- https://community.flexera.com/t5/InstallShield-Knowledge-Base/CVE-2021-41526-Privilege-escalation-vulnerability-during-MSI/ta-p/218137/jump-to/first-unread-messageVendor Advisory
- https://github.com/mandiant/Vulnerability-Disclosures/blob/master/MNDT-2021-0011/MNDT-2021-0011.mdThird Party Advisory
- http://seclists.org/fulldisclosure/2024/Apr/24
- https://community.flexera.com/t5/InstallShield-Knowledge-Base/CVE-2021-41526-Privilege-escalation-vulnerability-during-MSI/ta-p/218137/jump-to/first-unread-messageVendor Advisory
- https://github.com/mandiant/Vulnerability-Disclosures/blob/master/MNDT-2021-0011/MNDT-2021-0011.mdThird Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.