CVE-2021-20722CWE-427

CVE-2021-20722

High · published May 24, 2021

CVSS v3.1
7.8
EPSS
0%
Percentile
37.2
In the wild
Unconfirmed
What it is

Untrusted search path vulnerability in the installers of ScanSnap Manager prior to versions V7.0L20 and the Software Download Installer prior to WinSSInst2JP.exe and WinSSInst2iX1500JP.exe allows an attacker to gain privileges and execute arbitrary code with the privilege of the user invoking the installer via a Trojan horse DLL in an unspecified directory.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00440 · 37.2th percentile
Weakness
CWE-427 · Uncontrolled Search Path Element
Published
2021-05-24T08:15Z
Affected products (1)
ProductVersionsFixed in
fujitsu/scansnap_manager< 7.0l207.0l20
References (4)
https://scansnap.fujitsu.com/global/dl/ · af854a3a-2127-422b-91ae-364da2661108https://jvn.jp/en/jp/JVN65733194/index.html · af854a3a-2127-422b-91ae-364da2661108https://jvn.jp/en/jp/JVN65733194/index.html · [email protected]https://scansnap.fujitsu.com/global/dl/ · [email protected]
EPSS history
Timeline
  • 24 MAY 03:20Z
    Untrusted search path vulnerability in the installers of ScanSnap Manager prior to versions V7.0L20 and the Software Download Installer prior to…
    cvelistv5