CVE-2021-41379 - Windows Installer Elevation of Privilege Vulnerability

Back Back to CVE browser

HIGH KEV

Windows Installer Elevation of Privilege Vulnerability

Published Nov 10, 2021 ·Due Mar 17, 2022

7.8

HIGH

CVSS 3.1

EPSS 19.45%

Description

Windows Installer Elevation of Privilege Vulnerability

Affected products

Vendor Microsoft Product Windows 10 Version 1507 Default
n/a
- Version
  10.0.0
  Status
  affected
  Constraints
  <10.0.10240.19119
Vendor Microsoft Product Windows 10 Version 1607 Default
n/a
- Version
  10.0.0
  Status
  affected
  Constraints
  <10.0.14393.4770
Vendor Microsoft Product Windows 10 Version 1809 Default
n/a
- Version
  10.0.0
  Status
  affected
  Constraints
  <10.0.17763.2300
Vendor Microsoft Product Windows 10 Version 1909 Default
n/a
- Version
  10.0.0
  Status
  affected
  Constraints
  <10.0.18363.1916
Vendor Microsoft Product Windows 10 Version 2004 Default
n/a
- Version
  10.0.0
  Status
  affected
  Constraints
  <10.0.19041.1348
Vendor Microsoft Product Windows 10 Version 20H2 Default
n/a
- Version
  10.0.0
  Status
  affected
  Constraints
  <10.0.19042.1348
Vendor Microsoft Product Windows 10 Version 21H1 Default
n/a
- Version
  10.0.0
  Status
  affected
  Constraints
  <10.0.19043.1348
Vendor Microsoft Product Windows 11 version 21H2 Default
n/a
- Version
  10.0.0
  Status
  affected
  Constraints
  <10.0.22000.318
Vendor Microsoft Product Windows 7 Default
n/a
- Version
  6.1.0
  Status
  affected
  Constraints
  <6.1.7601.25769
Vendor Microsoft Product Windows 7 Service Pack 1 Default
n/a
- Version
  6.1.0
  Status
  affected
  Constraints
  <6.1.7601.25769
Vendor Microsoft Product Windows 8.1 Default
n/a
- Version
  6.3.0
  Status
  affected
  Constraints
  <6.3.9600.20174
Vendor Microsoft Product Windows Server 2008 Service Pack 2 Default
n/a
- Version
  6.0.0
  Status
  affected
  Constraints
  <6.0.6003.21282
Vendor Microsoft Product Windows Server 2008 R2 Service Pack 1 Default
n/a
- Version
  6.1.0
  Status
  affected
  Constraints
  <6.1.7601.25769
Vendor Microsoft Product Windows Server 2008 R2 Service Pack 1 (Server Core installation) Default
n/a
- Version
  6.0.0
  Status
  affected
  Constraints
  <6.1.7601.25769
Vendor Microsoft Product Windows Server 2008 Service Pack 2 Default
n/a
- Version
  6.0.0
  Status
  affected
  Constraints
  <6.0.6003.21282
Vendor Microsoft Product Windows Server 2008 Service Pack 2 (Server Core installation) Default
n/a
- Version
  6.0.0
  Status
  affected
  Constraints
  <6.0.6003.21282
Vendor Microsoft Product Windows Server 2012 Default
n/a
- Version
  6.2.0
  Status
  affected
  Constraints
  <6.2.9200.23517
Vendor Microsoft Product Windows Server 2012 (Server Core installation) Default
n/a
- Version
  6.2.0
  Status
  affected
  Constraints
  <6.2.9200.23517
Vendor Microsoft Product Windows Server 2012 R2 Default
n/a
- Version
  6.3.0
  Status
  affected
  Constraints
  <6.3.9600.20174
Vendor Microsoft Product Windows Server 2012 R2 (Server Core installation) Default
n/a
- Version
  6.3.0
  Status
  affected
  Constraints
  <6.3.9600.20174
Vendor Microsoft Product Windows Server 2016 Default
n/a
- Version
  10.0.0
  Status
  affected
  Constraints
  <10.0.14393.4770
Vendor Microsoft Product Windows Server 2016 (Server Core installation) Default
n/a
- Version
  10.0.0
  Status
  affected
  Constraints
  <10.0.14393.4770
Vendor Microsoft Product Windows Server 2019 Default
n/a
- Version
  10.0.0
  Status
  affected
  Constraints
  <10.0.17763.2300
Vendor Microsoft Product Windows Server 2019 (Server Core installation) Default
n/a
- Version
  10.0.0
  Status
  affected
  Constraints
  <10.0.17763.2300
Vendor Microsoft Product Windows Server 2022 Default
n/a
- Version
  10.0.0
  Status
  affected
  Constraints
  <10.0.20348.350
Vendor Microsoft Product Windows Server version 2004 Default
n/a
- Version
  10.0.0
  Status
  affected
  Constraints
  <10.0.19041.1348
Vendor Microsoft Product Windows Server version 20H2 Default
n/a
- Version
  10.0.0
  Status
  affected
  Constraints
  <10.0.19042.1348

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Microsoft

Windows 10 Version 1507

n/a

Version	Status	Constraints
10.0.0	affected	<10.0.10240.19119

Microsoft

Windows 10 Version 1607

n/a

Version	Status	Constraints
10.0.0	affected	<10.0.14393.4770

Microsoft

Windows 10 Version 1809

n/a

Version	Status	Constraints
10.0.0	affected	<10.0.17763.2300

Microsoft

Windows 10 Version 1909

n/a

Version	Status	Constraints
10.0.0	affected	<10.0.18363.1916

Microsoft

Windows 10 Version 2004

n/a

Version	Status	Constraints
10.0.0	affected	<10.0.19041.1348

Microsoft

Windows 10 Version 20H2

n/a

Version	Status	Constraints
10.0.0	affected	<10.0.19042.1348

Microsoft

Windows 10 Version 21H1

n/a

Version	Status	Constraints
10.0.0	affected	<10.0.19043.1348

Microsoft

Windows 11 version 21H2

n/a

Version	Status	Constraints
10.0.0	affected	<10.0.22000.318

Microsoft

Windows 7

n/a

Version	Status	Constraints
6.1.0	affected	<6.1.7601.25769

Microsoft

Windows 7 Service Pack 1

n/a

Version	Status	Constraints
6.1.0	affected	<6.1.7601.25769

Microsoft

Windows 8.1

n/a

Version	Status	Constraints
6.3.0	affected	<6.3.9600.20174

Microsoft

Windows Server 2008 Service Pack 2

n/a

Version	Status	Constraints
6.0.0	affected	<6.0.6003.21282

Microsoft

Windows Server 2008 R2 Service Pack 1

n/a

Version	Status	Constraints
6.1.0	affected	<6.1.7601.25769

Microsoft

Windows Server 2008 R2 Service Pack 1 (Server Core installation)

n/a

Version	Status	Constraints
6.0.0	affected	<6.1.7601.25769

Microsoft

Windows Server 2008 Service Pack 2

n/a

Version	Status	Constraints
6.0.0	affected	<6.0.6003.21282

Microsoft

Windows Server 2008 Service Pack 2 (Server Core installation)

n/a

Version	Status	Constraints
6.0.0	affected	<6.0.6003.21282

Microsoft

Windows Server 2012

n/a

Version	Status	Constraints
6.2.0	affected	<6.2.9200.23517

Microsoft

Windows Server 2012 (Server Core installation)

n/a

Version	Status	Constraints
6.2.0	affected	<6.2.9200.23517

Microsoft

Windows Server 2012 R2

n/a

Version	Status	Constraints
6.3.0	affected	<6.3.9600.20174

Microsoft

Windows Server 2012 R2 (Server Core installation)

n/a

Version	Status	Constraints
6.3.0	affected	<6.3.9600.20174

Microsoft

Windows Server 2016

n/a

Version	Status	Constraints
10.0.0	affected	<10.0.14393.4770

Microsoft

Windows Server 2016 (Server Core installation)

n/a

Version	Status	Constraints
10.0.0	affected	<10.0.14393.4770

Microsoft

Windows Server 2019

n/a

Version	Status	Constraints
10.0.0	affected	<10.0.17763.2300

Microsoft

Windows Server 2019 (Server Core installation)

n/a

Version	Status	Constraints
10.0.0	affected	<10.0.17763.2300

Microsoft

Windows Server 2022

n/a

Version	Status	Constraints
10.0.0	affected	<10.0.20348.350

Microsoft

Windows Server version 2004

n/a

Version	Status	Constraints
10.0.0	affected	<10.0.19041.1348

Microsoft

Windows Server version 20H2

n/a

Version	Status	Constraints
10.0.0	affected	<10.0.19042.1348

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-59

References (5)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-28407
Advisory
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-41379
vendor-advisorypatchVendor Advisory
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-41379
PatchVendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-41379
government-resourceUS Government Resource
https://www.zerodayinitiative.com/advisories/ZDI-21-1308/
Third Party AdvisoryVDB Entry

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-28407		Advisory
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-41379		vendor-advisorypatchVendor Advisory
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-41379		PatchVendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-41379		government-resourceUS Government Resource
https://www.zerodayinitiative.com/advisories/ZDI-21-1308/		Third Party AdvisoryVDB Entry