High severity · published Dec 21, 2022
CVE-2022-46330
Squirrel.Windows is both a toolset and a library that provides installation and update functionality for Windows desktop applications
7.8
CVSS
0.4%
EPSS
No
On KEV
Description
Squirrel.Windows is both a toolset and a library that provides installation and update functionality for Windows desktop applications. Installers generated by Squirrel.Windows 2.0.1 and earlier contain an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries. As a result, arbitrary code may be executed with the privilege of the user invoking the installer.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 35% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IG
Installers generated by Squirrel.Windows · Squirrel
2.0.1 and earlier · source: vendor
SQ
Squirrel.windows · Squirrel.windows Project
through 2.0.1 · source: NVD
Affected product
IG
Installers generated by Squirrel.Windows
Squirrel
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-46330
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-46330
Third Party Advisory
https://github.com/Squirrel/Squirrel.Windows
Patch
https://github.com/Squirrel/Squirrel.Windows/pull/1807
Third Party Advisory
https://jvn.jp/en/jp/JVN29902403/index.html