Encrypted Configuration File Vulnerability Affects WINSelect Standard and Enterprise

CVE-2024-36495

What is CVE-2024-36495?

Faronics WINSelect, both Standard and Enterprise versions, has a vulnerability where its configuration settings are saved in an encrypted file located at C:\ProgramData\WINSelect\WINSelect.wsd. This file, however, is accessible with read and write permissions for 'Everyone', potentially allowing unauthorized users to manipulate critical configuration data. Additionally, the Enterprise version stores its configuration file at C:\ProgramData\Faronics\StorageSpace\WS\WINSelect.wsd. Such a security lapse may lead to the exposure of sensitive system configurations and risks unauthorized access.

References