CVE-2022-46330 - Vulnerability Details - OpenCVE

Squirrel.Windows is both a toolset and a library that provides installation and update functionality for Windows desktop applications. Installers generated by Squirrel.Windows 2.0.1 and earlier contain an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries. As a result, arbitrary code may be executed with the privilege of the user invoking the installer.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00173.

Key SSVC decision points have not yet been added.

Vendors	Products
Squirrel.windows Project Subscribe	Squirrel.windows Subscribe

Configuration 1 [-]

cpe:2.3:a:squirrel.windows_project:squirrel.windows:*:*:*:*:*:*:*:*

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2022-49147	Squirrel.Windows is both a toolset and a library that provides installation and update functionality for Windows desktop applications. Installers generated by Squirrel.Windows 2.0.1 and earlier contain an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries. As a result, arbitrary code may be executed with the privilege of the user invoking the installer.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://github.com/Squirrel/Squirrel.Windows
https://github.com/Squirrel/Squirrel.Windows/pull/1807
https://jvn.jp/en/jp/JVN29902403/index.html

History

No history.

Projects

Sign in to view the affected projects.

MITRE

Status: PUBLISHED

Assigner: jpcert

Published: 2022-12-21T00:00:00.000Z

Updated: 2025-04-16T16:03:10.062Z

Reserved: 2022-12-14T00:00:00.000Z

Link: CVE-2022-46330

Vulnrichment

No data.

NVD

Status : Modified

Published: 2022-12-21T09:15:08.873

Modified: 2025-04-16T16:15:25.163

Link: CVE-2022-46330

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

CWE-427

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2022-46330", "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "assignerShortName": "jpcert", "dateUpdated": "2025-04-16T16:03:10.062Z", "dateReserved": "2022-12-14T00:00:00.000Z", "datePublished": "2022-12-21T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert", "dateUpdated": "2022-12-21T00:00:00.000Z"}, "descriptions": [{"lang": "en", "value": "Squirrel.Windows is both a toolset and a library that provides installation and update functionality for Windows desktop applications. Installers generated by Squirrel.Windows 2.0.1 and earlier contain an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries. As a result, arbitrary code may be executed with the privilege of the user invoking the installer."}], "affected": [{"vendor": "Squirrel", "product": "Installers generated by Squirrel.Windows", "versions": [{"version": "2.0.1 and earlier", "status": "affected"}]}], "references": [{"url": "https://github.com/Squirrel/Squirrel.Windows/pull/1807"}, {"url": "https://github.com/Squirrel/Squirrel.Windows"}, {"url": "https://jvn.jp/en/jp/JVN29902403/index.html"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "Uncontrolled Search Path Element"}]}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T14:31:46.282Z"}, "title": "CVE Program Container", "references": [{"url": "https://github.com/Squirrel/Squirrel.Windows/pull/1807", "tags": ["x_transferred"]}, {"url": "https://github.com/Squirrel/Squirrel.Windows", "tags": ["x_transferred"]}, {"url": "https://jvn.jp/en/jp/JVN29902403/index.html", "tags": ["x_transferred"]}]}, {"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-427", "lang": "en", "description": "CWE-427 Uncontrolled Search Path Element"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-04-16T16:02:36.212508Z", "id": "CVE-2022-46330", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-16T16:03:10.062Z"}}]}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:squirrel.windows_project:squirrel.windows:*:*:*:*:*:*:*:*", "matchCriteriaId": "2E59CD6A-B516-4B88-A405-BA498E4508AC", "versionEndIncluding": "2.0.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Squirrel.Windows is both a toolset and a library that provides installation and update functionality for Windows desktop applications. Installers generated by Squirrel.Windows 2.0.1 and earlier contain an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries. As a result, arbitrary code may be executed with the privilege of the user invoking the installer."}, {"lang": "es", "value": "Squirrel.Windows es un conjunto de herramientas y una librer\u00eda que proporciona funcionalidad de instalaci\u00f3n y actualizaci\u00f3n para aplicaciones de escritorio de Windows. Los instaladores generados por Squirrel.Windows 2.0.1 y versiones anteriores contienen un problema con la ruta de b\u00fasqueda de DLL, lo que puede provocar que se carguen librer\u00edas de v\u00ednculos din\u00e1micos de forma insegura. Como resultado, se puede ejecutar c\u00f3digo arbitrario con el privilegio del usuario que invoca el instalador."}], "id": "CVE-2022-46330", "lastModified": "2025-04-16T16:15:25.163", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2022-12-21T09:15:08.873", "references": [{"source": "vultures@jpcert.or.jp", "tags": ["Third Party Advisory"], "url": "https://github.com/Squirrel/Squirrel.Windows"}, {"source": "vultures@jpcert.or.jp", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/Squirrel/Squirrel.Windows/pull/1807"}, {"source": "vultures@jpcert.or.jp", "tags": ["Third Party Advisory"], "url": "https://jvn.jp/en/jp/JVN29902403/index.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://github.com/Squirrel/Squirrel.Windows"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/Squirrel/Squirrel.Windows/pull/1807"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://jvn.jp/en/jp/JVN29902403/index.html"}], "sourceIdentifier": "vultures@jpcert.or.jp", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-427"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-427"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}