CVE-2021-41526

HIGH

Flexera Revenera Installshield < 2021 - Privilege Escalation

Title source: rule

Description

A vulnerability has been reported in the windows installer (MSI) built with InstallScript custom action. This vulnerability may allow privilege escalation when invoked ‘repair’ of the MSI which has an InstallScript custom action.

References (3)

Core 3

Core References

Mailing List mailing-list

http://seclists.org/fulldisclosure/2024/Apr/24

Vendor Advisory

https://community.flexera.com/t5/InstallShield-Knowledge-Base/CVE-2021-41526-Privilege-escalation-vulnerability-during-MSI/ta-p/218137/jump-to/first-unread-message

Third Party Advisory

https://github.com/mandiant/Vulnerability-Disclosures/blob/master/MNDT-2021-0011/MNDT-2021-0011.md

View Writeup ZIP pw:eip

Scores

CVSS v3 7.8

EPSS 0.0007

EPSS Percentile 20.4%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

Status published

Products (2)

flexera/revenera_installshield 2021 (2 CPE variants)

flexera/revenera_installshield < 2021

Published Mar 29, 2023

Tracked Since Feb 18, 2026