A vulnerability has been found in InstallBuilder Qt Installer and classified as problematic. This vulnerability affects an unknown functionality. The manipulation with an unknown input leads to a uncontrolled search path vulnerability. The CWE definition for the vulnerability is CWE-427. The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

InstallBuilder Qt installers built with versions previous to 22.10 try to load DLLs from the installer binary parent directory when displaying popups. This may allow an attacker to plant a malicious DLL in the installer parent directory to allow executing code with the privileges of the installer (when the popup triggers the loading of the library). Exploiting these type of vulnerabilities generally require that an attacker has access to a vulnerable machine to plant the malicious DLL.

The weakness was published 11/19/2022. The advisory is available at blog.installbuilder.com. This vulnerability was named CVE-2022-31694 since 05/25/2022. The technical details are unknown and an exploit is not available. This vulnerability is assigned to T1574 by the MITRE ATT&CK project.

Upgrading to version 22.10 eliminates this vulnerability. The upgrade is hosted for download at blog.installbuilder.com.

Productinfo

Vendor

• InstallBuilder

Name

• Qt Installer

License

• open-source

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion