CVE-2021-22038

Katalog CVE

CVSS 8.8 · High EPSS 0,99%

Kerentanan Use of Insufficiently Random Values pada vmware installbuilder. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

On Windows, the uninstaller binary copies itself to a fixed temporary location, which is then executed (the originally called uninstaller exits, so it does not block the installation directory). This temporary location is not randomized and does not restrict access to Administrators only so a potential attacker could plant a binary to replace the copied binary right before it gets called, thus gaining Administrator privileges (if the original uninstaller was executed as Administrator). The vulnerability only affects Windows installers.

Rincian

Terbit di NVD

29 Oktober 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-330: Use of Insufficiently Random Values

EPSS (30 hari)

0,99% peluang dieksploitasi; lebih tinggi dari 61,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://blog.installbuilder.com/2021/10/installbuilder-2160-released.html release notes · advisory vendor