CVE-2024-36495: Read/Write Permissions for Everyone on Configuration File

Published Jun 24, 2024

Updated

The application Faronics WINSelect (Standard + Enterprise) saves its configuration in an encrypted file on the file system which "Everyone" has read and write access to, path to file:

C:\ProgramData\WINSelect\WINSelect.wsd

The path for the affected WINSelect Enterprise configuration file is:

C:\ProgramData\Faronics\StorageSpace\WS\WINSelect.wsd

Affected Software

1 affected component

Faronics WINSelect

Remediation

Information

The vendor provides a patched version 8.30.xx.903 since May 2024 which can be downloaded from the following URL: https://www.faronics.com/document-library/document/download-winselect-standard The vendor provided the following changelog: https://www.faronics.com/en-uk/document-library/document/winselect-standard-release-notes

Event History

Jun 24, 2024

CVE Published

via MITRE·08:50 AM

Data Sourced

via MITRE·08:50 AM

RemedyDescriptionWeakness

Data Sourced

via NVD·09:15 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2024-36495?

CVE-2024-36495 has been assessed as a high severity vulnerability due to improper file permissions allowing unauthorized access.

How do I fix CVE-2024-36495?

To fix CVE-2024-36495, restrict access to the C:\ProgramData\WINSelect\WINSelect.wsd configuration file to authorized users only.

What are the impacts of CVE-2024-36495?

The impacts of CVE-2024-36495 include the potential exposure of sensitive configuration data to unauthorized users.

Which versions of Faronics WINSelect are affected by CVE-2024-36495?

CVE-2024-36495 affects all versions of Faronics WINSelect, both Standard and Enterprise editions.

Is there a workaround for CVE-2024-36495?

A temporary workaround for CVE-2024-36495 is to manually adjust the file permissions of the WINSelect.wsd configuration file.