Skip to main content

Untrusted Search Path

CVE-2024-24810

High
7.8/10

Summary

WiX toolset lets developers create installers for Windows Installer, the Windows installation engine. The ".be" TEMP folder is vulnerable to DLL redirection attacks that allow the attacker to escalate privileges. This impacts any installer built with the WiX installer framework. This vulnerability affects wix package versions prior to 3.14.0, and 4.0.x prior to 4.0.4, PanelSW.Custom.WiX package versions prior to 3.15.0-a44, and PanelSwWix4.Sdk package versions prior to 5.0.0-psw-wix.0251-40.

  • LOW
  • LOCAL
  • HIGH
  • UNCHANGED
  • REQUIRED
  • NONE
  • HIGH
  • HIGH

CWE-426 - Untrusted Search Path

The application searches for critical resources using an externally-supplied search path that can point to resources that are not under the application's direct control.

References

Advisory Timeline

  • Published