CVE-2024-24810

WiX toolset lets developers create installers for Windows Installer, the Windows installation engine. The .be TEMP folder is vulnerable to DLL redirection attacks that allow the attacker to escalate privileges. This impacts any installer built with the WiX installer framework. This issue has been patched in version 4.0.4.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/wixtoolset/issues/security/advisories/GHSA-7wh2-wxc7-9ph5	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:firegiant:wix_toolset::::::::
	cpe:2.3:a:firegiant:wix_toolset::::::::

History

14 Feb 2024, 20:12

Type	Values Removed	Values Added
References	~~() https://github.com/wixtoolset/issues/security/advisories/GHSA-7wh2-wxc7-9ph5 -~~	() https://github.com/wixtoolset/issues/security/advisories/GHSA-7wh2-wxc7-9ph5 - Vendor Advisory
First Time		Firegiant Firegiant wix Toolset
CPE		cpe:2.3:a:firegiant:wix_toolset::::::::
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 7.8

07 Feb 2024, 03:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-02-07 03:15

Updated : 2024-02-28 20:54

NVD link : CVE-2024-24810

Mitre link : CVE-2024-24810

CVE.ORG link : CVE-2024-24810

JSON object : View

Products Affected

firegiant

wix_toolset

CWE

CWE-426

Untrusted Search Path

{"id": "CVE-2024-24810", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 1.5}]}, "published": "2024-02-07T03:15:50.273", "references": [{"url": "https://github.com/wixtoolset/issues/security/advisories/GHSA-7wh2-wxc7-9ph5", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-426"}]}], "descriptions": [{"lang": "en", "value": "WiX toolset lets developers create installers for Windows Installer, the Windows installation engine. The .be TEMP folder is vulnerable to DLL redirection attacks that allow the attacker to escalate privileges. This impacts any installer built with the WiX installer framework. This issue has been patched in version 4.0.4."}, {"lang": "es", "value": "El conjunto de herramientas WiX permite a los desarrolladores crear instaladores para Windows Installer, el motor de instalaci\u00f3n de Windows. La carpeta .be TEMP es vulnerable a ataques de redirecci\u00f3n de DLL que permiten al atacante escalar privilegios. Esto afecta a cualquier instalador creado con el marco de instalaci\u00f3n de WiX. Este problema se solucion\u00f3 en la versi\u00f3n 4.0.4."}], "lastModified": "2024-02-14T20:12:54.643", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:firegiant:wix_toolset:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AA99C3FD-4CDC-4DE0-9A04-0421E520E349", "versionEndExcluding": "3.14.0"}, {"criteria": "cpe:2.3:a:firegiant:wix_toolset:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1A6D8FCB-7ED5-4BD7-9B4F-1678DC7A1519", "versionEndExcluding": "4.0.4", "versionStartIncluding": "4.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}