Skip to content
OpenAdvisories
High · 7.7 CVE-2024-36495 EUVD-2024-36124GHSA-3g4h-66cq-c8vg

Read/Write Permissions for Everyone on Configuration File

Published Jun 24, 2024 · Updated Feb 13, 2025 · Assigned by SEC-VLab

Description

The application Faronics WINSelect (Standard + Enterprise) saves its configuration in an encrypted file on the file system which "Everyone" has read and write access to, path to file:

C:\ProgramData\WINSelect\WINSelect.wsd

The path for the affected WINSelect Enterprise configuration file is:

C:\ProgramData\Faronics\StorageSpace\WS\WINSelect.wsd

Affected products

VendorProductAffectedFixed
Faronics WINSelect (Standard + Enterprise) — 8.30.xx.903

References