CVE-2024-29187highCWE-732

CVE-2024-29187: fallo de gravedad alta en wixtoolset issues

WiX based installers are vulnerable to binary hijack when run as SYSTEM

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear issues+ Monitorear wix

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.3epss 0.5%
WiX toolset lets developers create installers for Windows Installer, the Windows installation engine. When a bundle runs as SYSTEM user, Burn uses GetTempPathW which points to an insecure directory C:\Windows\Temp to drop and load multiple binaries. Standard users can hijack the binary before it's loaded in the application resulting in elevation of privileges. This vulnerability is fixed in 3.14.1 and 4.0.5.
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Productos afectados
wixtoolset · issues
CVEs relacionadas — wixtoolset issues

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-29188HIGHMalicious directory junction can cause WiX RemoveFoldersEx to possibly delete elevated filesEPSS 0.2%CVE-2024-24810HIGHWiX is vulnerable to DLL redirection attacks that allow the attacker to escalate privilegesEPSS 0.2%