Vulnerability Description
WiX toolset lets developers create installers for Windows Installer, the Windows installation engine. When a bundle runs as SYSTEM user, Burn uses GetTempPathW which points to an insecure directory C:\Windows\Temp to drop and load multiple binaries. Standard users can hijack the binary before it's loaded in the application resulting in elevation of privileges. This vulnerability is fixed in 3.14.1 and 4.0.5.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/wixtoolset/issues/security/advisories/GHSA-rf39-3f98-xr7r
- https://github.com/wixtoolset/wix/commit/75a8c75d4e02ea219008dc5af7d03869291d61f
- https://github.com/wixtoolset/wix3/commit/6d372e5169f1a334a395cdf496443bc0732098
- https://github.com/wixtoolset/issues/security/advisories/GHSA-rf39-3f98-xr7r
- https://github.com/wixtoolset/wix/commit/75a8c75d4e02ea219008dc5af7d03869291d61f
- https://github.com/wixtoolset/wix3/commit/6d372e5169f1a334a395cdf496443bc0732098
FAQ
What is CVE-2024-29187?
CVE-2024-29187 is a vulnerability with a CVSS score of 7.3 (HIGH). WiX toolset lets developers create installers for Windows Installer, the Windows installation engine. When a bundle runs as SYSTEM user, Burn uses GetTempPathW which points to an insecure directory C:...
How severe is CVE-2024-29187?
CVE-2024-29187 has been rated HIGH with a CVSS base score of 7.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-29187?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.