CVE-2023-29080

Jan. 30, 2025, 6:15 p.m.

None
No Score

Description

Potential privilege escalation vulnerability in Revenera InstallShield versions 2022 R2 and 2021 R2 due to adding InstallScript custom action to a Basic MSI or InstallScript MSI project extracting few binaries to a predefined writable folder during installation time. The standard user account has write access to these files and folders, hence replacing them during installation time can lead to a DLL hijacking vulnerability.

Product(s) Impacted

Product Versions
InstallShield
  • 2022 R2
  • 2021 R2

Weaknesses

CWE-552
Files or Directories Accessible to External Parties
The product makes files or directories accessible to unauthorized actors, even though they should not be.

References

https://community.revenera.com/s/article/cve-2023-29080-security-patch-for-the-possible-privileged-escalation-scenarios-identified-in-installshield-nbsp

Tags

CWE-552
2025-01-30
PSIRT-CNA@flexerasoftware.com
CVE-2023-29080

Date

  • Published: Jan. 30, 2025, 6:15 p.m.
  • Last Modified: Jan. 30, 2025, 6:15 p.m.

Status : Awaiting Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

PSIRT-CNA@flexerasoftware.com

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.