Vulnerability in Wixtoolset Issues
CVE-2024-29187
WiX toolset lets developers create installers for Windows Installer, the Windows installation engine. When a bundle runs as SYSTEM user, Burn uses GetTempPathW which points to an insecure directory C:\Windows\Temp to drop and load multiple binaries. Standard users can hijack the binary before it's loaded in the application resulting in elevation of privileges. This vulnerability is fixed in 3.14.1 and 4.0.5.
EPSS: 0.005 (37.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.3 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H.
Affected products
- Wixtoolset Issues — versions < 3.14.1, >= 4.0.0, < 4.0.5
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security-advisories@github.com (x_refsource_CONFIRM)
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC)
Frequently asked questions
- What is CVE-2024-29187?
- CVE-2024-29187 is a high-severity vulnerability in Wixtoolset Issues, classified under Incorrect Permission Assignment for Critical Resource. CVSS score: 7.3/10. Published 2024-03-24.
- How severe is CVE-2024-29187?
- High severity. CVSS v3 base score is 7.3 out of 10.
- Is CVE-2024-29187 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.