CVE-2024-29188
CVSS 3.1 Score 7.9 of 10 (high)
Details
Summary
CVE-2024-29188 is a vulnerability found in the WiX toolset, which is used to create installers for Windows Installer. The vulnerability allows a standard user to delete protected directories by exploiting the `RemoveFolderEx` functionality. This feature deletes an entire directory tree during installation or uninstallation. By creating a directory junction in a per-user folder that points to a per-machine protected directory, an attacker can trick Windows Installer into deleting the target of the junction. This vulnerability has a high severity rating and requires low privileges and user interaction to exploit. It poses a potential danger to organizations as it can result in the unauthorized deletion of important directories. The vulnerability has been fixed in versions 3.14.1 and 4.0.5 of WiX toolset.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions