CVE-2024-27303

CVSS 3.1 Score 7.3 of 10 (high)

Details

Published Mar 6, 2024
CWE ID 427
CWE ID 426

Summary

CVE-2024-27303 is a vulnerability that affects electron-builder prior to version 24.13.2 in Windows. The vulnerability occurs in the NSIS installer script, where a system call is made to open cmd.exe via NSExec. By default, NSExec searches the current directory of the installer before searching `PATH`. This means that if an attacker can place a malicious executable file named cmd.exe in the same folder as the installer, the installer will run the malicious file. The issue is fixed in version 24.13.2, and there is no known workaround for this vulnerability. It poses a high risk to organizations as it allows an attacker to execute arbitrary code on the system during the installation process, potentially leading to unauthorized access, data leakage, or system compromise.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.

Share

Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future

Note: This is just a basic overview providing quick insights into CVE-2024-27303 information. Gain full access to comprehensive CVE data, third party vulnerabilities, compromised credentials and more with Recorded Future
  • Gain complete coverage of your cyber, third party, and physical attack surface
  • Proactively mitigate threats before they turn into costly attacks
  • Make fast, effective, data-driven decisions

Book your demo

Sign in

Back to Vulnerability Database