CVE Vulnerabilities

CVE-2015-9267

Improper Privilege Management

Published: Oct 01, 2018 | Modified: Mar 15, 2021
CVSS 3.x
5.5
MEDIUM
Source:
NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS 2.x
3.6 LOW
AV:L/AC:L/Au:N/C:N/I:P/A:P
RedHat/V2
RedHat/V3
Ubuntu
MEDIUM

Nullsoft Scriptable Install System (NSIS) before 2.49 uses temporary folder locations that allow unprivileged local users to overwrite files. This allows a local attack in which either a plugin or the uninstaller can be replaced by a Trojan horse program.

Weakness

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Affected Software

Name Vendor Start Version End Version
Nullsoft_scriptable_install_system Nullsoft * 2.49 (excluding)
Nsis Ubuntu trusty *
Nsis Ubuntu trusty/esm *
Nsis Ubuntu upstream *

Potential Mitigations

References