CVE-2021-438907.1High

CVE-2021-43890: Windows AppX Installer Spoofing Vulnerability

Microsoft · App Installer

Vendor fix available · Affected: Microsoft App Installer · Exploitation: in CISA KEV since 15 Dec 2021

Known ransomware use

Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.

ExploitationIn CISA KEV

In CISA KEVCISA KEV catalogue15 Dec 2021
Exploited (reported): not seen
Scanning observed: not seen
Proof of concept public: not seen
Not established: not seen

11.3%probability of exploitation in the next 30 days

96th percentile

050100

Higher than 96% of scored CVEs

7.1HighCVSS 3.1

LowMediumHighCrit.

DescriptionCVE.org

We have investigated reports of a spoofing vulnerability in AppX installer that affects Microsoft Windows. Microsoft is aware of attacks that attempt to exploit this vulnerability by using specially crafted packages that include the malware family known as Emotet/Trickbot/Bazaloader. An attacker could craft a malicious attachment to be used in phishing campaigns. The attacker would then have to convince the user to open the specially crafted attachment. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. Please see the Security Updates table for the link to the updated app. Alternatively you can download and install the Installer using the links provided in the FAQ section. Please see the Mitigations and Workaround sections for important information about steps you can take to protect your system from this vulnerability. December 27 2023 Update: In recent months, Microsoft Threat Intelligence has seen an increase in activity from threat actors leveraging social engineering and phishing techniques to target Windows OS users and utilizing the ms-appinstaller URI scheme. To address this increase in activity, we have updated the App Installer to disable the ms-appinstaller protocol by default and recommend other potential mitigations.

Affected products1

From the CVE record. A product or version that is not listed is unknown, not unaffected.

Microsoft · App Installerfrom 1.0.0.0 before publication

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas

Exploitation: Exploited in the wild. Listed in the CISA Known Exploited Vulnerabilities catalogue.
CISA KEV: Listed since 15 Dec 2021 · known ransomware use · catalogue entry
Public check: No public nuclei template
Vendor: Microsoft
Published: December 2021
Band: Exploited in the wild, December 2021

What changed

5 Nov
CISA’s KEV entry now notes known ransomware use CISA
15 Dec 2021
CISA added it to the KEV catalogue CISA

CoverageNo articles yet

No CyberSIXT article names CVE-2021-43890 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.