CVE-2024-36497 Unhashed Storage of Password

2024-06-2409:06:03

CWE-312

SEC-VLab

github.com

cve-2024-36497

password

cleartext

winselect

AI Score

Confidence

Low

EPSS

Percentile

15.6%

SSVC

Exploitation

poc

Automatable

yes

Technical Impact

total

JSON

The decrypted configuration file contains the password in cleartext
which is used to configure WINSelect. It can be used to remove the
existing restrictions and disable WINSelect entirely.

CNA Affected

[
  {
    "vendor": "Faronics",
    "product": "WINSelect (Standard + Enterprise)",
    "versions": [
      {
        "status": "unaffected",
        "version": "8.30.xx.903",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "affected"
  }
]

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:faronics:winselect:*:*:*:*:*:*:*:*"
    ],
    "vendor": "faronics",
    "product": "winselect",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "8.30.xx.903",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  }
]