CVE-2022-46330
Last modified
CVE-2022-46330 is a high-severity vulnerability rated 7.8/10 on the CVSS scale. Squirrel.Windows is both a toolset and a library that provides installation and update functionality for Windows desktop applications. Installers generated by Squirrel.Windows 2.0.1 and earlier contain an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries. EPSS estimates a 0.39% chance of exploitation in the next 30 days.
Description
Squirrel.Windows is both a toolset and a library that provides installation and update functionality for Windows desktop applications. Installers generated by Squirrel.Windows 2.0.1 and earlier contain an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries. As a result, arbitrary code may be executed with the privilege of the user invoking the installer.
Metrics
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Squirrel.Windows Project | Squirrel.Windows | <= 2.0.1 |
References
- https://github.com/Squirrel/Squirrel.WindowsThird Party Advisory
- https://github.com/Squirrel/Squirrel.Windows/pull/1807Patch, Third Party Advisory
- https://jvn.jp/en/jp/JVN29902403/index.htmlThird Party Advisory
- https://github.com/Squirrel/Squirrel.WindowsThird Party Advisory
- https://github.com/Squirrel/Squirrel.Windows/pull/1807Patch, Third Party Advisory
- https://jvn.jp/en/jp/JVN29902403/index.htmlThird Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-46330?
How severe is CVE-2022-46330?
How do I fix CVE-2022-46330?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-46325Some smartphones have the out-of-bounds write vulnerability.…9.8
- CVE-2022-46326Some smartphones have the out-of-bounds write vulnerability.…9.8
- CVE-2022-46327Some smartphones have configuration issues. Successful explo…9.8
- CVE-2022-46328Some smartphones have the input validation vulnerability. Su…7.5
- CVE-2022-46329Protection mechanism failure for some Intel(R) PROSet/Wirele…6.7
- CVE-2022-4633A vulnerability was found in Auto Upload Images up to 3.3.0 …8.8
- CVE-2022-46331 An unauthorized user could possibly delete any file on th…8.1
- CVE-2022-46332The Admin Smart Search feature in Proofpoint Enterprise Prot…9.6
- CVE-2022-46333The admin user interface in Proofpoint Enterprise Protection…7.2
- CVE-2022-46334Proofpoint Enterprise Protection (PPS/PoD) contains a vulner…7.8
- CVE-2022-46335Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2022-46336Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
Are you affected by CVE-2022-46330?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST