CVE-2024-29188

{
  "id": "CVE-2024-29188",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-29188",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-03-28T18:20:54.492822Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 7.9,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 5.8,
        "exploitabilityScore": 1.5
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "wixtoolset",
          "product": "issues",
          "versions": [
            {
              "status": "affected",
              "version": "< 3.14.1"
            },
            {
              "status": "affected",
              "version": ">= 4.0.0, < 4.0.5"
            }
          ]
        }
      ]
    }
  ],
  "published": "2024-03-24T20:15:08.243",
  "references": [
    {
      "url": "https://github.com/wixtoolset/issues/security/advisories/GHSA-jx4p-m4wm-vvjg",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/wixtoolset/wix/commit/2e5960b575881567a8807e6b8b9c513138b19742",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/wixtoolset/wix3/commit/93eeb5f6835776694021f66d4226c262c67d487a",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/wixtoolset/issues/security/advisories/GHSA-jx4p-m4wm-vvjg",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/wixtoolset/wix/commit/2e5960b575881567a8807e6b8b9c513138b19742",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/wixtoolset/wix3/commit/93eeb5f6835776694021f66d4226c262c67d487a",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-59"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "WiX toolset lets developers create installers for Windows Installer, the Windows installation engine. The custom action behind WiX's `RemoveFolderEx` functionality could allow a standard user to delete protected directories. `RemoveFolderEx` deletes an entire directory tree during installation or uninstallation. It does so by recursing every subdirectory starting at a specified directory and adding each subdirectory to the list of directories Windows Installer should delete. If the setup author instructed `RemoveFolderEx` to delete a per-user folder from a per-machine installer, an attacker could create a directory junction in that per-user folder pointing to a per-machine, protected directory. Windows Installer, when executing the per-machine installer after approval by an administrator, would delete the target of the directory junction. This vulnerability is fixed in 3.14.1 and 4.0.5."
    },
    {
      "lang": "es",
      "value": "El conjunto de herramientas WiX permite a los desarrolladores crear instaladores para Windows Installer, el motor de instalación de Windows. La acción personalizada detrás de la funcionalidad `RemoveFolderEx` de WiX podría permitir a un usuario estándar eliminar directorios protegidos. `RemoveFolderEx` elimina un árbol de directorios completo durante la instalación o desinstalación. Lo hace recurriendo a cada subdirectorio comenzando en un directorio específico y agregando cada subdirectorio a la lista de directorios que Windows Installer debe eliminar. Si el autor de la instalación indicó a `RemoveFolderEx` que eliminara una carpeta por usuario de un instalador por máquina, un atacante podría crear una unión de directorios en esa carpeta por usuario que apunte a un directorio protegido por máquina. Windows Installer, al ejecutar el instalador por máquina después de la aprobación de un administrador, eliminaría el destino de la unión del directorio. Esta vulnerabilidad se solucionó en 3.14.1 y 4.0.5."
    }
  ],
  "lastModified": "2026-06-17T07:22:35.413",
  "sourceIdentifier": "security-advisories@github.com"
}