CVE-2021-22037

{"id": "CVE-2021-22037", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.4, "accessVector": "LOCAL", "vectorString": "AV:L/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 3.4, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2021-10-29T12:15:07.573", "references": [{"url": "https://blog.installbuilder.com/2021/10/installbuilder-2160-released.html", "tags": ["Release Notes", "Vendor Advisory"], "source": "security@vmware.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-427"}]}], "descriptions": [{"lang": "en", "value": "Under certain circumstances, when manipulating the Windows registry, InstallBuilder uses the reg.exe system command. The full path to the command is not enforced, which results in a search in the search path until a binary can be identified. This makes the installer/uninstaller vulnerable to Path Interception by Search Order Hijacking, potentially allowing an attacker to plant a malicious reg.exe command so it takes precedence over the system command. The vulnerability only affects Windows installers."}, {"lang": "es", "value": "En determinadas circunstancias, cuando se manipula el registro de Windows, InstallBuilder usa el comando de sistema reg.exe. No se aplica la ruta completa del comando, que resulta en se busque en la ruta de b\u00fasqueda hasta que se pueda identificar un binario. Esto hace que el instalador/desinstalador sea vulnerable a una Interceptaci\u00f3n de la Ruta mediante el Secuestro del Orden de B\u00fasqueda, permitiendo potencialmente a un atacante plantar un comando reg.exe malicioso para que tenga prioridad sobre el comando del sistema. La vulnerabilidad s\u00f3lo afecta a los instaladores de Windows"}], "lastModified": "2021-11-03T18:23:27.017", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:vmware:installbuilder:*:*:*:*:*:windows:*:*", "vulnerable": true, "matchCriteriaId": "11DF34E9-7BCA-48D3-9B1D-A146D7B34769", "versionEndExcluding": "21.6.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@vmware.com"}