Skip to content
OpenAdvisories
High · 8.5 CVE-2023-29080 EUVD-2023-32683GHSA-jgh6-r92w-wgcf

Privilege escalation in InstallShield

Published Jan 30, 2025 · Updated Feb 12, 2025 · Assigned by flexera

Description

Potential privilege escalation vulnerability in Revenera InstallShield versions 2022 R2 and 2021 R2 due to adding InstallScript custom action to a Basic MSI or InstallScript MSI project extracting few binaries to a predefined writable folder during installation time. The standard user account has write access to these files and folders, hence replacing them during installation time can lead to a DLL hijacking vulnerability.

Affected products

VendorProductAffectedFixed
Revenera InstallShield 2022 R2 – < 2022 R2 (28.0.0.763), 2021 R2 – < 2021 R2 (27.0.0.126) 2022 R2 (28.0.0.763)

Advisories 1

References