CVE-2024-29187

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-29187
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-29187.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-29187
Aliases
Published
2024-03-24T19:38:38.140Z
Modified
2026-03-12T02:53:51.476780Z
Severity
  • 7.3 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
Summary
WiX based installers are vulnerable to binary hijack when run as SYSTEM
Details

WiX toolset lets developers create installers for Windows Installer, the Windows installation engine. When a bundle runs as SYSTEM user, Burn uses GetTempPathW which points to an insecure directory C:\Windows\Temp to drop and load multiple binaries. Standard users can hijack the binary before it's loaded in the application resulting in elevation of privileges. This vulnerability is fixed in 3.14.1 and 4.0.5.

Database specific 
{
    "cwe_ids": [
        "CWE-732"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/29xxx/CVE-2024-29187.json"
}
References

Affected packages

Git / github.com/wixtoolset/wix

Affected ranges

Type
GIT
Repo
https://github.com/wixtoolset/wix
Events
Introduced
8c757c0f67f26f21c6bcbbfb81b7ea8b91c35fe4
Fixed
b9b2f1b4c69a1b509d487dc950b30b4ec9b0d040
Database specific 
{
    "versions": [
        {
            "introduced": "4.0.0"
        },
        {
            "fixed": "4.0.5"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-29187.json"