Preface: Sometimes vulnerability causes by misconfiguration.

Vulnerability details: MinGW (http://www.mingw.org/) provides a complete Open Source programming tool set which is suitable for the development of native MS-Windows applications, and which do not depend on any 3rd-party C-Runtime DLLs. For OpenSSL versions 1.1.0 and 1.1.1, the mingw configuration targets assume that resulting programs and libraries are installed in a Unix-like environment. Therefore the default prefix for program installation as well as for OPENSSLDIR should be ‘/usr/local’.
Unfortunately when similar concept implement to MS Windows environment. The /use/local will be world writable.
In additional, some build instructions for the diverse Windows targets on 1.0.2 encourage you to specify your own –prefix.
OpenSSL versions 1.1.1, 1.1.0 and 1.0.2 are affected by this issue.

By default, the OpenSSL directory is /usr/local/ssl. If you perform a config without –prefix and without –openssldir, that’s what you get by default.

Above vulnerability has been recorded on CVE database (CVE-2019-1552). One years more later software vendor (Macrium) encountered similar of design defect (CVE-2020-10143). Please refer to link – https://kb.cert.org/vuls/id/760767

Workaround: Ensure that the OPENSSLDIR path is set to a location that is only writable by the system itself.