CVE-2021-1727
published 2021-02-25CVE-2021-1727: Windows Installer Elevation of Privilege Vulnerability
PriorityP338high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.76%
51.0th percentile
Windows Installer Elevation of Privilege Vulnerability
Affected
46 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10_version_1507 | >= 10.0.0 < publication | publication |
| microsoft | windows_10_version_1607 | >= 10.0.0 < publication | publication |
| microsoft | windows_10_version_1803 | >= 10.0.0 < publication | publication |
| microsoft | windows_10_version_1809 | >= 10.0.0 < publication | publication |
| microsoft | windows_10_version_1909 | >= 10.0.0 < publication | publication |
| microsoft | windows_10_version_2004 | >= 10.0.0 < publication | publication |
| microsoft | windows_10_version_20h2 | >= 10.0.0 < publication | publication |
| microsoft | windows_7 | >= 6.1.0 < publication | publication |
| microsoft | windows_7_service_pack_1 | >= 6.1.0 < publication | publication |
| microsoft | windows_8.1 | >= 6.3.0 < publication | publication |
| microsoft | windows_server_2008 | — | — |
| microsoft | windows_server_2008_r2_service_pack_1 | >= 6.0.0 < publication | publication |
| microsoft | windows_server_2008_r2_service_pack_1 | >= 6.1.0 < publication | publication |
| microsoft | windows_server_2008_service_pack_2 | >= 6.0.0 < publication | publication |
| microsoft | windows_server_2012 | — | — |
| microsoft | windows_server_2012 | >= 6.2.0 < publication | publication |
| microsoft | windows_server_2012_r2 | >= 6.3.0 < publication | publication |
| microsoft | windows_server_2016 | — | — |
| microsoft | windows_server_2016 | — | — |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.04.6MEDIUMAV:L/AC:L/Au:N/C:P/I:P/A:P
vendor_msrc7.8HIGH
vendor_cisco4.2MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Microsoft
Windows Installer Elevation of Privilege Vulnerability
vendor_msrc·2021-02-09·CVSS 7.8
CVE-2021-1727 [HIGH] Windows Installer Elevation of Privilege Vulnerability
Windows Installer Elevation of Privilege Vulnerability
Windows Installer: Windows Installer
Microsoft: Microsoft
Impact: Elevation of Privilege
Exploit Status: Publicly Disclosed:Yes;Exploited:No;Latest Software Release:Exploitation More Likely;Older Software Release:Exploitation More Likely;DOS:N/A
Reference: https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4601354
Reference: https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4601345
Reference: https://support.microsoft.com/help/4601345
Reference: https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4601315
Reference: https://support.microsoft.com/help/4601315
Reference: https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4601319
Reference: https://support.microsoft.com/help/4601319
Refer
Cisco
Cisco NX-OS Software Python Parser Privilege Escalation Vulnerability
vendor_cisco·2019-05-15·CVSS 4.2
CVE-2019-1727 [MEDIUM] CWE-264 Cisco NX-OS Software Python Parser Privilege Escalation Vulnerability
Cisco NX-OS Software Python Parser Privilege Escalation Vulnerability
Update from August 25, 2021: Cisco found that this vulnerability was present in additional releases of Cisco NX-OS Software with the introduction of Python 3 support. For more information, see the Fixed Software section of this advisory.
A vulnerability in the Python scripting subsystem of Cisco NX-OS Software could allow an authenticated, local attacker to escape the Python parser and issue arbitrary commands to elevate the attacker's privilege level.
This vulnerability is due to insufficient sanitization of user-supplied parameters that are passed to certain Python functions in the scripting sandbox of the affected device. An attacker could exploit this vulnerability to escape the scripting sandbox and execute arbitr
Cisco
Cisco NX-OS Software Python Parser Privilege Escalation Vulnerability
vendor_cisco·CVSS 3.0
CVE-2019-1727 Cisco NX-OS Software Python Parser Privilege Escalation Vulnerability
CVE-2019-1727: Cisco NX-OS Software Python Parser Privilege Escalation Vulnerability
Update from August 25, 2021: Cisco found that this vulnerability was present in additional releases of Cisco NX-OS Software with the introduction of Python 3 support. For more information, see the Fixed Software section of this advisory. A vulnerability in the Python scripting subsystem of Cisco NX-OS Software could allow an authenticated, local attacker to escape the Python parser and issue arbitrary commands to elevate the attacker's privilege level. This vulnerability is due to insufficient sanitization of user-supplied parameters that are passed to certain Python functions in the scripting sandbox of the affected device. An attacker could exploit this vulnerability to escape the scripting sandbox and e
GHSA
GHSA-gff2-2v38-hmc4: Windows Installer Elevation of Privilege Vulnerability
ghsa_unreviewed·2022-05-24
CVE-2021-1727 [HIGH] CWE-269 GHSA-gff2-2v38-hmc4: Windows Installer Elevation of Privilege Vulnerability
Windows Installer Elevation of Privilege Vulnerability
No detection rules found.
No public exploits indexed.
2021-02-25
Published