Vulnerability · Published Dec 21, 2022 · Assigned by jpcert
CVE-2022-46330
High 7.8
In plain English
A high-severity uncontrolled search path in Installers generated by Squirrel.Windows from Squirrel. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities).
Official description
Squirrel.Windows is both a toolset and a library that provides installation and update functionality for Windows desktop applications. Installers generated by Squirrel.Windows 2.0.1 and earlier contain an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries. As a result, arbitrary code may be executed with the privilege of the user invoking the installer.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Squirrel | Installers generated by Squirrel.Windows | 2.0.1 and earlier |
Weakness: CWE-427 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H