CVE-2024-36495CWE-276

Read/Write Permissions for Everyone on Configuration File

High · published June 24, 2024

CVSS v3.1
7.7
EPSS
0%
Percentile
23.0
In the wild
Unconfirmed
What it is

The application Faronics WINSelect (Standard + Enterprise) saves its configuration in an encrypted file on the file system which "Everyone" has read and write access to, path to file:

C:\ProgramData\WINSelect\WINSelect.wsd

The path for the affected WINSelect Enterprise configuration file is:

C:\ProgramData\Faronics\StorageSpace\WS\WINSelect.wsd

The record
Technical detail
CVSS v3.1
7.7 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00313 · 23.0th percentile
Weakness
CWE-276 · Incorrect Default Permissions
Published
2024-06-24T08:50Z
EPSS history
Timeline
  • 24 JUN 08:50Z
    Read/Write Permissions for Everyone on Configuration File
    cvelistv5