CVE-2021-41379
Published: 10 November 2021
Summary
CVE-2021-41379 is a medium-severity Link Following (CWE-59) vulnerability in Microsoft Windows Server 2008. Its CVSS base score is 5.5 (Medium).
Operationally, ranked in the top 22.3% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and AC-3 (Access Enforcement).
Deeper analysis
CVE-2021-41379 is an elevation of privilege vulnerability in the Windows Installer component, tracked under CWE-59 for improper link resolution before file access. It received a CVSS 3.1 score of 5.5 with a vector indicating local attack vector, low attack complexity, low privileges required, no user interaction, and high availability impact.
A local attacker with low privileges can exploit the flaw to elevate privileges and achieve high impact on system availability. The vulnerability affects Windows systems running the Installer service and can be triggered without additional user interaction once local access is obtained.
Microsoft security advisories recommend applying the patches referenced in the CVE entry to address the issue. The vulnerability is also catalogued by CISA as actively exploited in the wild, confirming real-world use beyond proof-of-concept reporting from sources such as Zero Day Initiative.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2021-28407
Vulnerability details
Windows Installer Elevation of Privilege Vulnerability
- CWE(s)
- KEV Date Added
- 03 March 2022
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely application of the vendor patches that close the Windows Installer link-resolution flaw.
Enforces least-privilege execution so a low-privileged local account cannot reach the vulnerable installer code paths that enable elevation.
Access-enforcement mechanisms block the unauthorized file operations that the CWE-59 flaw would otherwise allow during installation.