CVE-2024-36497 Unhashed Storage of Password

2024-06-2409:06:03

CWE-312

SEC-VLab

www.cve.org

unhashed storage

password

winselect configuration

decrypted file

cleartext

existing restrictions

disable

0.0004 Low

EPSS

Percentile

15.7%

JSON

The decrypted configuration file contains the password in cleartext
which is used to configure WINSelect. It can be used to remove the
existing restrictions and disable WINSelect entirely.

CNA Affected

[
  {
    "defaultStatus": "affected",
    "product": "WINSelect (Standard + Enterprise)",
    "vendor": "Faronics",
    "versions": [
      {
        "status": "unaffected",
        "version": "8.30.xx.903",
        "versionType": "custom"
      }
    ]
  }
]