PT-2024-27029 · Faronics · Winselect

Daniel Hirschberger · Published 2024-06-24 · Updated 2024-07-08 · CVE-2024-36495

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Faronics WINSelect (Standard + Enterprise) (affected versions not specified)

Description The application saves its configuration in an encrypted file on the file system, which "Everyone" has read and write access to. The paths to the configuration files are C:ProgramDataWINSelectWINSelect.wsd for the standard version and C:ProgramDataFaronicsStorageSpaceWSWINSelect.wsd for the enterprise version.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2024-36495

Affected Products

Winselect

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-36495 · Security Note
• http://seclists.org/fulldisclosure/2024/Jun/12 · Note
• https://t.me/cvenotify/84156 · Telegram Post
• https://r.sec-consult.com/winselect · Note
• https://faronics.com/en-uk/document-library/document/winselect-standard-release-notes · Note
• https://t.me/cvenotify/84313 · Telegram Post