Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    4 vulnerabilities found for inno_setup by jrsoftware

    CVE-2025-15595 (GCVE-0-2025-15595)

    Vulnerability from nvd – Published: 2026-03-03 06:13 – Updated: 2026-03-03 14:37
    VLAI
    Title
    Privilege escalation via dll hijacking in Inno Setup
    Summary
    Privilege escalation via dll hijacking in Inno Setup 6.2.1 and ealier versions.
    Severity
    5.7 (Medium)
    CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H/E:U/AU:N/U:Clear
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-03-03 14:37 UTC
    CWE
    Assigner
    References
    Impacted products
    Vendor Product Version
    mlsoft Inno Setup Affected: 0 , ≤ 6.2.1 (custom)
    Unaffected: 6.2.2
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-15595",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-03T14:37:18.075340Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-03T14:37:26.000Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Inno Setup",
          "vendor": "mlsoft",
          "versions": [
            {
              "lessThanOrEqual": "6.2.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "6.2.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Privilege escalation via dll hijacking in Inno Setup 6.2.1 and ealier versions.\u0026nbsp;"
            }
          ],
          "value": "Privilege escalation via dll hijacking in Inno Setup 6.2.1 and ealier versions."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-233",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-233 Privilege Escalation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NO",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 5.7,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "UNREPORTED",
            "privilegesRequired": "LOW",
            "providerUrgency": "CLEAR",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H/E:U/AU:N/U:Clear",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1390",
              "description": "CWE-1390: Weak Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-03T06:13:07.636Z",
        "orgId": "db4dfee8-a97e-4877-bfae-eba6d14a2166",
        "shortName": "NCSC-FI"
      },
      "references": [
        {
          "url": "https://jrsoftware.org/files/is6.2-whatsnew.htm"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update to 6.2.2 or later"
            }
          ],
          "value": "Update to 6.2.2 or later"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Privilege escalation via dll hijacking in Inno Setup",
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "db4dfee8-a97e-4877-bfae-eba6d14a2166",
    "assignerShortName": "NCSC-FI",
    "cveId": "CVE-2025-15595",
    "datePublished": "2026-03-03T06:13:07.636Z",
    "dateReserved": "2026-02-27T06:49:37.922Z",
    "dateUpdated": "2026-03-03T14:37:26.000Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2017-20051 (GCVE-0-2017-20051)

    Vulnerability from nvd – Published: 2022-06-16 06:15 – Updated: 2026-09-29 05:56
    VLAI
    Title
    InnoSetup Installer uncontrolled search path
    Summary
    A vulnerability was detected in InnoSetup Installer 5.5.9. This affects an unknown part. The manipulation results in uncontrolled search path. The attack can be executed remotely. The exploit is now public and may be used. This is a malformed-PE / self-extracting-installer defect report that the vendor never acknowledged.
    Severity
    5.3 (Medium)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
    6.3 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:U/RC:R
    6.3 (Medium)
    CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:U/RC:R
    SSVC
    Exploitation: poc Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2025-04-14 17:11 UTC
    CWE
    Assigner
    References
    URL Tags
    https://vuldb.com/vuln/97837 vdb-entry
    https://vuldb.com/vuln/97837/cti signaturepermissions-required
    https://vuldb.com/cve/CVE-2017-20051 third-party-advisory
    http://seclists.org/fulldisclosure/2017/Mar/8 exploitmailing-list
    https://vuldb.com/?id.97837 x_refsource_MISCx_transferred
    Impacted products
    Vendor Product Version
    InnoSetup Installer Affected: 5.5.9
        cpe:2.3:a:innosetup:installer:*:*:*:*:*:*:*:*
    		Create a notification for this product.
    Credits
    Stefan Kanthak
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T21:45:25.374Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2017/Mar/8"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://vuldb.com/?id.97837"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2017-20051",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-14T17:11:18.734072Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-15T14:25:02.579Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:innosetup:installer:*:*:*:*:*:*:*:*"
          ],
          "product": "Installer",
          "vendor": "InnoSetup",
          "versions": [
            {
              "status": "affected",
              "version": "5.5.9"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Stefan Kanthak"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was detected in InnoSetup Installer 5.5.9. This affects an unknown part. The manipulation results in uncontrolled search path. The attack can be executed remotely. The exploit is now public and may be used. This is a malformed-PE / self-extracting-installer defect report that the vendor never acknowledged."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:U/RC:R",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:U/RC:R",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 6,
            "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P/E:POC/RL:U/RC:UR",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-427",
              "description": "Uncontrolled Search Path",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-426",
              "description": "Untrusted Search Path",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-29T05:56:55.900Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-97837 | InnoSetup Installer uncontrolled search path",
          "tags": [
            "vdb-entry"
          ],
          "url": "https://vuldb.com/vuln/97837"
        },
        {
          "name": "VDB-97837 | CTI Indicators (IOB, IOC, TTP)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/97837/cti"
        },
        {
          "name": "CVE-2017-20051 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2017-20051"
        },
        {
          "tags": [
            "exploit",
            "mailing-list"
          ],
          "url": "http://seclists.org/fulldisclosure/2017/Mar/8"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2017-02-25T01:00:00.000Z",
          "value": "Vendor informed"
        },
        {
          "lang": "en",
          "time": "2017-03-06T01:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2017-03-06T01:00:00.000Z",
          "value": "Exploit disclosed"
        },
        {
          "lang": "en",
          "time": "2017-03-11T01:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-09-29T08:01:41.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "InnoSetup Installer uncontrolled search path",
      "x_generator": [
        "VulDB PVTS v202609"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2017-20051",
    "datePublished": "2022-06-16T06:15:18.000Z",
    "dateReserved": "2022-06-08T00:00:00.000Z",
    "dateUpdated": "2026-09-29T05:56:55.900Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2025-15595 (GCVE-0-2025-15595)

    Vulnerability from cvelistv5 – Published: 2026-03-03 06:13 – Updated: 2026-03-03 14:37
    VLAI
    Title
    Privilege escalation via dll hijacking in Inno Setup
    Summary
    Privilege escalation via dll hijacking in Inno Setup 6.2.1 and ealier versions.
    Severity
    5.7 (Medium)
    CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H/E:U/AU:N/U:Clear
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-03-03 14:37 UTC
    CWE
    Assigner
    References
    Impacted products
    Vendor Product Version
    mlsoft Inno Setup Affected: 0 , ≤ 6.2.1 (custom)
    Unaffected: 6.2.2
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-15595",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-03T14:37:18.075340Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-03T14:37:26.000Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Inno Setup",
          "vendor": "mlsoft",
          "versions": [
            {
              "lessThanOrEqual": "6.2.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "6.2.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Privilege escalation via dll hijacking in Inno Setup 6.2.1 and ealier versions.\u0026nbsp;"
            }
          ],
          "value": "Privilege escalation via dll hijacking in Inno Setup 6.2.1 and ealier versions."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-233",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-233 Privilege Escalation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NO",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 5.7,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "UNREPORTED",
            "privilegesRequired": "LOW",
            "providerUrgency": "CLEAR",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H/E:U/AU:N/U:Clear",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1390",
              "description": "CWE-1390: Weak Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-03T06:13:07.636Z",
        "orgId": "db4dfee8-a97e-4877-bfae-eba6d14a2166",
        "shortName": "NCSC-FI"
      },
      "references": [
        {
          "url": "https://jrsoftware.org/files/is6.2-whatsnew.htm"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update to 6.2.2 or later"
            }
          ],
          "value": "Update to 6.2.2 or later"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Privilege escalation via dll hijacking in Inno Setup",
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "db4dfee8-a97e-4877-bfae-eba6d14a2166",
    "assignerShortName": "NCSC-FI",
    "cveId": "CVE-2025-15595",
    "datePublished": "2026-03-03T06:13:07.636Z",
    "dateReserved": "2026-02-27T06:49:37.922Z",
    "dateUpdated": "2026-03-03T14:37:26.000Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2017-20051 (GCVE-0-2017-20051)

    Vulnerability from cvelistv5 – Published: 2022-06-16 06:15 – Updated: 2026-09-29 05:56
    VLAI
    Title
    InnoSetup Installer uncontrolled search path
    Summary
    A vulnerability was detected in InnoSetup Installer 5.5.9. This affects an unknown part. The manipulation results in uncontrolled search path. The attack can be executed remotely. The exploit is now public and may be used. This is a malformed-PE / self-extracting-installer defect report that the vendor never acknowledged.
    Severity
    5.3 (Medium)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
    6.3 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:U/RC:R
    6.3 (Medium)
    CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:U/RC:R
    SSVC
    Exploitation: poc Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2025-04-14 17:11 UTC
    CWE
    Assigner
    References
    URL Tags
    https://vuldb.com/vuln/97837 vdb-entry
    https://vuldb.com/vuln/97837/cti signaturepermissions-required
    https://vuldb.com/cve/CVE-2017-20051 third-party-advisory
    http://seclists.org/fulldisclosure/2017/Mar/8 exploitmailing-list
    https://vuldb.com/?id.97837 x_refsource_MISCx_transferred
    Impacted products
    Vendor Product Version
    InnoSetup Installer Affected: 5.5.9
        cpe:2.3:a:innosetup:installer:*:*:*:*:*:*:*:*
    		Create a notification for this product.
    Credits
    Stefan Kanthak
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T21:45:25.374Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2017/Mar/8"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://vuldb.com/?id.97837"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2017-20051",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-14T17:11:18.734072Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-15T14:25:02.579Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:innosetup:installer:*:*:*:*:*:*:*:*"
          ],
          "product": "Installer",
          "vendor": "InnoSetup",
          "versions": [
            {
              "status": "affected",
              "version": "5.5.9"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Stefan Kanthak"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was detected in InnoSetup Installer 5.5.9. This affects an unknown part. The manipulation results in uncontrolled search path. The attack can be executed remotely. The exploit is now public and may be used. This is a malformed-PE / self-extracting-installer defect report that the vendor never acknowledged."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:U/RC:R",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:U/RC:R",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 6,
            "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P/E:POC/RL:U/RC:UR",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-427",
              "description": "Uncontrolled Search Path",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-426",
              "description": "Untrusted Search Path",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-29T05:56:55.900Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-97837 | InnoSetup Installer uncontrolled search path",
          "tags": [
            "vdb-entry"
          ],
          "url": "https://vuldb.com/vuln/97837"
        },
        {
          "name": "VDB-97837 | CTI Indicators (IOB, IOC, TTP)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/97837/cti"
        },
        {
          "name": "CVE-2017-20051 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2017-20051"
        },
        {
          "tags": [
            "exploit",
            "mailing-list"
          ],
          "url": "http://seclists.org/fulldisclosure/2017/Mar/8"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2017-02-25T01:00:00.000Z",
          "value": "Vendor informed"
        },
        {
          "lang": "en",
          "time": "2017-03-06T01:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2017-03-06T01:00:00.000Z",
          "value": "Exploit disclosed"
        },
        {
          "lang": "en",
          "time": "2017-03-11T01:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-09-29T08:01:41.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "InnoSetup Installer uncontrolled search path",
      "x_generator": [
        "VulDB PVTS v202609"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2017-20051",
    "datePublished": "2022-06-16T06:15:18.000Z",
    "dateReserved": "2022-06-08T00:00:00.000Z",
    "dateUpdated": "2026-09-29T05:56:55.900Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}