{
  "containers": {
    "cna": {
      "providerMetadata": {
        "dateUpdated": "2026-09-30T17:36:21.043Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "rejectedReasons": [
        {
          "lang": "en",
          "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: The sole source documents PE-format conformance defects in innosetup-5.5.9.exe with no exploit, attack path, or untrusted search path condition (CWE-426/427), and the author states Windows loads these files normally; the record\u0027s remote/exploited claims are unsupported, as is the product maintainer\u0027s contention."
        }
      ],
      "x_generator": [
        "VulDB PVTS v202609"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2017-20051",
    "datePublished": "2022-06-16T06:15:18.000Z",
    "dateRejected": "2026-09-30T17:36:21.043Z",
    "dateReserved": "2022-06-08T00:00:00.000Z",
    "dateUpdated": "2026-09-30T17:36:21.043Z",
    "state": "REJECTED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"http://seclists.org/fulldisclosure/2017/Mar/8\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://vuldb.com/?id.97837\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-05T21:45:25.374Z\"}}, {\"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-04-14T17:11:21.305Z\"}, \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2017-20051\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-04-14T17:11:18.734072Z\"}}}], \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"title\": \"InnoSetup Installer uncontrolled search path\", \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Stefan Kanthak\"}], \"metrics\": [{\"cvssV4_0\": {\"version\": \"4.0\", \"baseScore\": 5.3, \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P\"}}, {\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 6.3, \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:U/RC:R\"}}, {\"cvssV3_0\": {\"version\": \"3.0\", \"baseScore\": 6.3, \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:U/RC:R\"}}, {\"cvssV2_0\": {\"version\": \"2.0\", \"baseScore\": 6, \"vectorString\": \"AV:N/AC:M/Au:S/C:P/I:P/A:P/E:POC/RL:U/RC:UR\"}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:innosetup:installer:*:*:*:*:*:*:*:*\"], \"vendor\": \"InnoSetup\", \"product\": \"Installer\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.5.9\"}]}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2017-02-25T01:00:00.000Z\", \"value\": \"Vendor informed\"}, {\"lang\": \"en\", \"time\": \"2017-03-06T01:00:00.000Z\", \"value\": \"Advisory disclosed\"}, {\"lang\": \"en\", \"time\": \"2017-03-06T01:00:00.000Z\", \"value\": \"Exploit disclosed\"}, {\"lang\": \"en\", \"time\": \"2017-03-11T01:00:00.000Z\", \"value\": \"VulDB entry created\"}, {\"lang\": \"en\", \"time\": \"2026-09-29T08:01:41.000Z\", \"value\": \"VulDB entry last update\"}], \"references\": [{\"url\": \"https://vuldb.com/vuln/97837\", \"name\": \"VDB-97837 | InnoSetup Installer uncontrolled search path\", \"tags\": [\"vdb-entry\"]}, {\"url\": \"https://vuldb.com/vuln/97837/cti\", \"name\": \"VDB-97837 | CTI Indicators (IOB, IOC, TTP)\", \"tags\": [\"signature\", \"permissions-required\"]}, {\"url\": \"https://vuldb.com/cve/CVE-2017-20051\", \"name\": \"CVE-2017-20051 | CVE Analysis and Report\", \"tags\": [\"third-party-advisory\"]}, {\"url\": \"http://seclists.org/fulldisclosure/2017/Mar/8\", \"tags\": [\"exploit\", \"mailing-list\"]}], \"x_generator\": [\"VulDB PVTS v202609\"], \"descriptions\": [{\"lang\": \"en\", \"value\": \"A vulnerability was detected in InnoSetup Installer 5.5.9. This affects an unknown part. The manipulation results in uncontrolled search path. The attack can be executed remotely. The exploit is now public and may be used. This is a malformed-PE / self-extracting-installer defect report that the vendor never acknowledged.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-427\", \"description\": \"Uncontrolled Search Path\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-426\", \"description\": \"Untrusted Search Path\"}]}], \"providerMetadata\": {\"orgId\": \"1af790b2-7ee1-4545-860a-a788eba489b5\", \"shortName\": \"VulDB\", \"dateUpdated\": \"2026-09-29T05:56:55.900Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2017-20051\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-09-29T05:56:55.900Z\", \"dateReserved\": \"2022-06-08T00:00:00.000Z\", \"assignerOrgId\": \"1af790b2-7ee1-4545-860a-a788eba489b5\", \"datePublished\": \"2022-06-16T06:15:18.000Z\", \"assignerShortName\": \"VulDB\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}