CVE-2017-20051

Published Jun 16, 2022 CVSS n/a EPSS n/a KEV · Not listed

Description

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: The sole source documents PE-format conformance defects in innosetup-5.5.9.exe with no exploit, attack path, or untrusted search path condition (CWE-426/427), and the author states Windows loads these files normally; the record's remote/exploited claims are unsupported, as is the product maintainer's contention.

Analysis

Affected Products

No data.

No data available yet.

Remediation

No remediation available yet

Tracking

Advisories

Source	ID	Title
EUVD	EUVD-2017-11066	A vulnerability was found in InnoSetup Installer. It has been declared as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to uncontrolled search path. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

Metrics

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

References

No reference.

History

Nov 3, 2026 6:30 PM Title updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Title	InnoSetup Installer uncontrolled search path
Metrics	ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 30, 2026 6:30 PM Weaknesses updated. Affected versions updated. Affected vendors updated. References updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses	CWE-426 CWE-427
CPEs	cpe:2.3:a:jrsoftware:inno_setup:-:::::::*
Vendors & Products	Jrsoftware Jrsoftware inno Setup
References	http://seclists.org/fulldisclosure/2017/Mar/8 https://vuldb.com/?id.97837 https://vuldb.com/cve/CVE-2017-20051 https://vuldb.com/vuln/97837 https://vuldb.com/vuln/97837/cti
Metrics	cvssV2_0 `{'score': 6.0, 'vector': 'AV:N/AC:M/Au:S/C:P/I:P/A:P'}` cvssV3_1 `{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L'}` cvssV4_0 `{'score': 2.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X'}`

Sep 30, 2026 5:45 PM Description updated. Affected versions updated. Affected vendors updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description	A vulnerability was detected in InnoSetup Installer 5.5.9. This affects an unknown part. The manipulation results in uncontrolled search path. The attack can be executed remotely. The exploit is now public and may be used. This is a malformed-PE / self-extracting-installer defect report that the vendor never acknowledged.	REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: The sole source documents PE-format conformance defects in innosetup-5.5.9.exe with no exploit, attack path, or untrusted search path condition (CWE-426/427), and the author states Windows loads these files normally; the record's remote/exploited claims are unsupported, as is the product maintainer's contention.
CPEs	cpe:2.3:a:innosetup:installer::::::::
Vendors & Products	Innosetup Innosetup installer
Metrics	cvssV3_0 `{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:U/RC:R'}` cvssV2_0 `{'score': 6, 'vector': 'AV:N/AC:M/Au:S/C:P/I:P/A:P/E:POC/RL:U/RC:UR'}` cvssV3_1 `{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:U/RC:R'}` cvssV4_0 `{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}`	cvssV2_0 `{'score': 6.0, 'vector': 'AV:N/AC:M/Au:S/C:P/I:P/A:P'}` cvssV3_1 `{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L'}` cvssV4_0 `{'score': 2.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X'}`

Sep 29, 2026 6:15 AM Description updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description	A vulnerability was found in InnoSetup Installer. It has been declared as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to uncontrolled search path. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.	A vulnerability was detected in InnoSetup Installer 5.5.9. This affects an unknown part. The manipulation results in uncontrolled search path. The attack can be executed remotely. The exploit is now public and may be used. This is a malformed-PE / self-extracting-installer defect report that the vendor never acknowledged.
First Time appeared		Innosetup Innosetup installer
Weaknesses		CWE-426
CPEs		cpe:2.3:a:innosetup:installer::::::::
Vendors & Products		Innosetup Innosetup installer
References		https://vuldb.com/cve/CVE-2017-20051 https://vuldb.com/vuln/97837 https://vuldb.com/vuln/97837/cti
Metrics	cvssV2_0 `{'score': 4.4, 'vector': 'AV:L/AC:M/Au:N/C:P/I:P/A:P'}` cvssV3_1 `{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L'}`	cvssV3_0 `{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:U/RC:R'}` cvssV4_0 `{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}` cvssV2_0 `{'score': 6, 'vector': 'AV:N/AC:M/Au:S/C:P/I:P/A:P/E:POC/RL:U/RC:UR'}` cvssV3_1 `{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:U/RC:R'}`