-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
C#C#Miggo AIRoot Cause AnalysisThe vulnerability stems from two key behaviors: (1) using the user's TEMP directory (instead of a secure system location) when not running as admin, and (2) failing to restrict write access to the .be directory. The first function CreateTempDirectory directly creates the insecure .be folder, while the second PathGetTempPath enables the unsafe TEMP selection. Both are critical to the DLL redirection attack vector described in the advisory. The confidence is high because these functions align with the described exploit mechanics (CWE-426) and WiX Burn engine architecture, even without explicit code examples.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| PanelSW.Custom.WiX | nuget | < 3.15.0-a44 | 3.15.0-a44 |