Lucene search

Veracode Vulnerability DatabaseVERACODE:46047

HistoryMar 28, 2024 - 4:49 a.m.

Insecure Temporary File Usage

2024-03-2804:49:32

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

vulnerability

insufficient protection

privilege escalation

low privilege users

installation binaries

7.3 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

6.8 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.5%

JSON

wixtoolset.sdk,wix is vulnerable to Insecure Temporary File Usage. The vulnerability is due to insufficient protection against low privilege users tampering with installation binaries, which can result in privilege escalation.

CPENameOperatorVersion
wixtoolset.sdkle4.0.4
wixle3.14.0
wixle4.0.4
wixtoolset.sdkle4.0.4
wixle3.14.0
wixle4.0.4

Name	Operator	Version
wixtoolset.sdk	le	4.0.4
wix	le	3.14.0
wix	le	4.0.4
wixtoolset.sdk	le	4.0.4
wix	le	3.14.0
wix	le	4.0.4

References

github.com/wixtoolset/issues/security/advisories/GHSA-rf39-3f98-xr7r

github.com/wixtoolset/wix/commit/75a8c75d4e02ea219008dc5af7d03869291d61f7

github.com/wixtoolset/wix3/commit/6d372e5169f1a334a395cdf496443bc0732098e9

7.3 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

6.8 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.5%

JSON

Related for VERACODE:46047