Vulnerability · Published Dec 20, 2021 · Assigned by THA-PSIRT
CVE-2021-42808The Sentinel Protection Installer 7.7.0 creates files and directory with all privileges granting any user full permissions.
Medium 6.5
In plain English
A medium-severity improper access control in Sentinel Protection Installer from Thales. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.2%top 85.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Improper Access Control in Thales Sentinel Protection Installer could allow a local user to escalate privileges.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Thales | Sentinel Protection Installer | 7.7.0 – through 7.7.0 |
Weakness: CWE-284 · Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H